api_hashes_fnv1_64

YARA detection rule by filescanio
Rule api_hashes_fnv1_64 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_fnv1_64 : hardened
{
	strings:
		$ControlService = {((96 9e 09 7f d6 4e 7b f1) | (f1 7b 4e d6 7f 09 9e 96))}
		$HttpSendRequestA = {((3a 9d 75 ce c8 73 3d ef) | (ef 3d 73 c8 ce 75 9d 3a))}
		$SetThreadPriority = {((ea 1e 3c d9 d2 d0 60 17) | (17 60 d0 d2 d9 3c 1e ea))}
		$Recv = {((88 11 71 7e 0c 85 75 19) | (19 75 85 0c 7e 71 11 88))}
		$QueryPerformanceFrequency = {((b3 8b 29 2e f0 2b 8b 7b) | (7b 8b 2b f0 2e 29 8b b3))}
		$RegDeleteValueA = {((b3 64 69 de 7e e2 fc d0) | (d0 fc e2 7e de 69 64 b3))}
		$GetWindowsDirectoryA = {((00 4a 7a 03 9c 01 af 54) | (54 af 01 9c 03 7a 4a 00))}
		$CryptSetKeyParam = {((d5 5f 04 57 34 c6 16 09) | (09 16 c6 34 57 04 5f d5))}
		$RegCreateKeyExA = {((04 f1 5c d2 4b 46 6e fe) | (fe 6e 46 4b d2 5c f1 04))}
		$Module32Next = {((f5 d8 b5 7f f4 da 3e b1) | (b1 3e da f4 7f b5 d8 f5))}
		$RegOpenUserClassesRoot = {((ad 9a 15 08 21 c9 3d 48) | (48 3d c9 21 08 15 9a ad))}
		$NtReadVirtualMemoryEx = {((72 21 39 d0 62 94 a3 06) | (06 a3 94 62 d0 39 21 72))}
		$InternetOpenA = {((6c 39 63 f0 4c b7 55 83) | (83 55 b7 4c f0 63 39 6c))}
		$URLOpenBlockingStream = {((d1 97 30 b1 0d f9 6f b5) | (b5 6f f9 0d b1 30 97 d1))}
		$NtSetInformationThread = {((3b c0 e1 56 4b f3 53 cd) | (cd 53 f3 4b 56 e1 c0 3b))}
		$CreateFileA = {((4e 93 b3 f7 1b b0 f6 b8) | (b8 f6 b0 1b f7 b3 93 4e))}
		$UnhookWindowsHookEx = {((c2 3f 28 15 c6 2f 9c da) | (da 9c 2f c6 15 28 3f c2))}
		$GetCurrentThreadId = {((f4 e2 d9 6e de 1e 72 c5) | (c5 72 1e de 6e d9 e2 f4))}
		$Accept = {((a7 9b 5d 05 c8 10 cb 11) | (11 cb 10 c8 05 5d 9b a7))}
		$HeapReAlloc = {((3e 73 5a 15 29 8a 89 8b) | (8b 89 8a 29 15 5a 73 3e))}
		$WinExec = {((26 68 90 00 3d f6 c6 fe) | (fe c6 f6 3d 00 90 68 26))}
		$NtQueueApcThreadEx = {((bb fd 7c 74 3d 5c 6e 3d) | (3d 6e 5c 3d 74 7c fd bb))}
		$VirtualAllocFromApp = {((5c 8d 58 58 74 0e 4c 86) | (86 4c 0e 74 58 58 8d 5c))}
		$RegLoadKeyA = {((86 df 35 3a 21 c3 69 3b) | (3b 69 c3 21 3a 35 df 86))}
		$OutputDebugStringA = {((76 9c 9b 09 d3 33 da 69) | (69 da 33 d3 09 9b 9c 76))}
		$GetFileAttributesA = {((60 ac 40 d9 80 dc 12 33) | (33 12 dc 80 d9 40 ac 60))}
		$SetWaitableTimer = {((6d 6a 22 65 2a 58 f4 f3) | (f3 f4 58 2a 65 22 6a 6d))}
		$SendMessageA = {((57 29 73 6b 6b da 33 51) | (51 33 da 6b 6b 73 29 57))}
		$RegUnLoadKeyA = {((d1 8f 57 bb 3c 33 2d 96) | (96 2d 33 3c bb 57 8f d1))}
		$SetEnvironmentVariableA = {((fa 72 0c fa 0f d9 12 bf) | (bf 12 d9 0f fa 0c 72 fa))}
		$VirtualAlloc2 = {((35 a5 f7 d9 19 8c c4 89) | (89 c4 8c 19 d9 f7 a5 35))}
		$CryptProtectData = {((18 dd 21 b0 53 e5 f7 3c) | (3c f7 e5 53 b0 21 dd 18))}
		$GetDesktopWindow = {((b0 61 7f 3a de 90 48 75) | (75 48 90 de 3a 7f 61 b0))}
		$RegGetKeySecurity = {((e2 f1 94 4f 9f 1c d6 f6) | (f6 d6 1c 9f 4f 94 f1 e2))}
		$GetDC = {((9a cc ac 88 b6 7e 46 44) | (44 46 7e b6 88 ac cc 9a))}
		$LookupPrivilegeValueA = {((bf 3c 37 53 82 b7 14 40) | (40 14 b7 82 53 37 3c bf))}
		$CryptGetHashParam = {((1f 11 6e 79 b3 53 2c dc) | (dc 2c 53 b3 79 6e 11 1f))}
		$HeapAlloc = {((24 27 8e 15 43 24 15 4e) | (4e 15 24 43 15 8e 27 24))}
		$RegCloseKey = {((b5 8c 3e 84 24 00 fa 50) | (50 fa 00 24 84 3e 8c b5))}
		$CryptHashData = {((0c 63 fb bc 68 22 eb fb) | (fb eb 22 68 bc fb 63 0c))}
		$GlobalAlloc = {((6c 6b 55 c4 3e 40 35 13) | (13 35 40 3e c4 55 6b 6c))}
		$RegOverridePredefKey = {((dd 4a db 6a e0 a5 b2 36) | (36 b2 a5 e0 6a db 4a dd))}
		$EnumSystemLocalesA = {((ef f4 44 b2 f5 1d 87 7f) | (7f 87 1d f5 b2 44 f4 ef))}
		$GetProcessId = {((cc 9b 44 50 92 f9 65 f9) | (f9 65 f9 92 50 44 9b cc))}
		$RegLoadMUIStringA = {((9e 55 b7 44 6f 0c a7 0c) | (0c a7 0c 6f 44 b7 55 9e))}
		$SearchPathA = {((91 67 61 00 41 07 76 e9) | (e9 76 07 41 00 61 67 91))}
		$FindClose = {((50 67 19 42 91 5f 38 28) | (28 38 5f 91 42 19 67 50))}
		$NtDeleteValueKey = {((2e fc 52 3f 6d c7 97 de) | (de 97 c7 6d 3f 52 fc 2e))}
		$URLDownloadToFile = {((d4 03 b0 01 fe d3 ca 1d) | (1d ca d3 fe 01 b0 03 d4))}
		$Toolhelp32ReadProcessMemory = {((de 8e 77 a2 f3 f6 9c 79) | (79 9c f6 f3 a2 77 8e de))}
		$GetProcAddress = {((9d 32 46 ca e9 2d 0c 49) | (49 0c 2d e9 ca 46 32 9d))}
		$OpenProcessToken = {((dc e9 c6 7a 09 7a f7 9f) | (9f f7 7a 09 7a c6 e9 dc))}
		$HeapCreate = {((64 95 ba 18 4e 1f 15 83) | (83 15 1f 4e 18 ba 95 64))}
		$UuidFromStringA = {((95 31 ca 73 25 c8 62 0c) | (0c 62 c8 25 73 ca 31 95))}
		$VirtualProtectEx = {((b4 63 27 fd 54 b1 41 fc) | (fc 41 b1 54 fd 27 63 b4))}
		$GetSystemTimeAsFileTime = {((4a 12 24 8b 80 f6 d2 1a) | (1a d2 f6 80 8b 24 12 4a))}
		$GetModuleBaseNameA = {((d3 73 4e 7b 85 65 d2 86) | (86 d2 65 85 7b 4e 73 d3))}
		$lstrcatA = {((90 8f 40 b9 73 31 35 d9) | (d9 35 31 73 b9 40 8f 90))}
		$SetFileAttributesA = {((29 0b e0 bf a0 11 f3 2f) | (2f f3 11 a0 bf e0 0b 29))}
		$FindResourceA = {((a8 15 9b 38 06 2f 03 99) | (99 03 2f 06 38 9b 15 a8))}
		$WaitForMultipleObjects = {((56 a9 d2 da 71 22 09 45) | (45 09 22 71 da d2 a9 56))}
		$QueryPerformanceCounter = {((ab e9 92 ef c1 49 e3 f1) | (f1 e3 49 c1 ef 92 e9 ab))}
		$NtCreateThreadEx = {((ae c7 39 42 b8 ea 48 fc) | (fc 48 ea b8 42 39 c7 ae))}
		$NtContinue = {((14 e6 0e dc 0e ee 17 7c) | (7c 17 ee 0e dc 0e e6 14))}
		$IsWoW64Process = {((a0 17 c4 bb 4d 13 6e ff) | (ff 6e 13 4d bb c4 17 a0))}
		$DnsQuery_A = {((bc 87 bf b4 c5 a8 fc ea) | (ea fc a8 c5 b4 bf 87 bc))}
		$VirtualProtectFromApp = {((a9 ab f7 5c 14 c4 07 80) | (80 07 c4 14 5c f7 ab a9))}
		$GetAsyncKeyState = {((08 2c 0b 9e 22 0e 9f f5) | (f5 9f 0e 22 9e 0b 2c 08))}
		$EncryptFileA = {((e9 3d d7 89 13 ef 70 d3) | (d3 70 ef 13 89 d7 3d e9))}
		$DuplicateToken = {((87 01 4f 6e c2 ad da d7) | (d7 da ad c2 6e 4f 01 87))}
		$CryptDeriveKey = {((cd 39 0c 0b a9 33 ff 1f) | (1f ff 33 a9 0b 0c 39 cd))}
		$LockResource = {((37 71 36 6a aa 89 7c d4) | (d4 7c 89 aa 6a 36 71 37))}
		$ResumeThread = {((3f 5e fc 48 60 b7 1f f4) | (f4 1f b7 60 48 fc 5e 3f))}
		$WaitForSingleObjectEx = {((25 63 e7 81 4c 40 b7 e9) | (e9 b7 40 4c 81 e7 63 25))}
		$NtSuspendProcess = {((c9 ee 5a 4c 5d 4b 2f b8) | (b8 2f 4b 5d 4c 5a ee c9))}
		$NetShareCheck = {((1a 1f c3 8d a3 9d ae b9) | (b9 ae 9d a3 8d c3 1f 1a))}
		$OpenThread = {((72 cf 6c d2 7b 7d b2 89) | (89 b2 7d 7b d2 6c cf 72))}
		$URLOpenStream = {((4a 0f c4 08 70 ac 92 20) | (20 92 ac 70 08 c4 0f 4a))}
		$UnmapViewOfFile = {((82 c2 c7 0a 90 2a 72 44) | (44 72 2a 90 0a c7 c2 82))}
		$CreateFile2 = {((4e 93 b3 f7 1b b0 f6 cb) | (cb f6 b0 1b f7 b3 93 4e))}
		$DeleteService = {((13 82 05 8b 8b 7d 1c 75) | (75 1c 7d 8b 8b 05 82 13))}
		$GetThreadId = {((12 11 5c f2 cc 6e 96 88) | (88 96 6e cc f2 5c 11 12))}
		$RegDeleteKeyA = {((fb 9d 0e 3c df 80 45 be) | (be 45 80 df 3c 0e 9d fb))}
		$CreateTimerQueueTimer = {((c1 73 59 3c 79 5b fd 48) | (48 fd 5b 79 3c 59 73 c1))}
		$SetProcessDEPPolicy = {((7f e1 9b c5 ce 86 92 43) | (43 92 86 ce c5 9b e1 7f))}
		$CreateServiceA = {((2b c1 74 ab 49 8d 22 eb) | (eb 22 8d 49 ab 74 c1 2b))}
		$ExitWindowsEx = {((0f ab d8 77 ea b1 29 2b) | (2b 29 b1 ea 77 d8 ab 0f))}
		$NtMapViewOfSection = {((3b 9d b7 b5 bc c6 8e 6c) | (6c 8e c6 bc b5 b7 9d 3b))}
		$NtTerminateThread = {((13 18 68 d3 6e 05 d6 84) | (84 d6 05 6e d3 68 18 13))}
		$Process32First = {((97 b6 ef 36 05 4f 85 d3) | (d3 85 4f 05 36 ef b6 97))}
		$RegCreateKeyTransactedA = {((ea 60 0d 5e 24 01 c8 f0) | (f0 c8 01 24 5e 0d 60 ea))}
		$GetUserNameA = {((46 ad 83 03 96 61 ec 84) | (84 ec 61 96 03 83 ad 46))}
		$MapVirtualKeyA = {((9c ac 37 6d 87 a7 94 20) | (20 94 a7 87 6d 37 ac 9c))}
		$WNetCloseEnum = {((a2 c4 af db 9b b1 3e ec) | (ec 3e b1 9b db af c4 a2))}
		$InternetReadFileExA = {((4f be 87 30 30 57 c4 f0) | (f0 c4 57 30 30 87 be 4f))}
		$GetComputerNameA = {((16 24 5d 1e b8 fa 40 6e) | (6e 40 fa b8 1e 5d 24 16))}
		$RegFlushKey = {((62 ed 50 41 5b c1 c6 da) | (da c6 c1 5b 41 50 ed 62))}
		$VirtualAllocEx = {((b5 c9 23 e6 6a 32 bb e2) | (e2 bb 32 6a e6 23 c9 b5))}
		$GetSystemDefaultLangId = {((7d f8 22 c5 65 64 5c a0) | (a0 5c 64 65 c5 22 f8 7d))}
		$SetFileTime = {((9b e6 8e 67 d4 b5 ce 9e) | (9e ce b5 d4 67 8e e6 9b))}
		$SendNotifyMessageA = {((86 61 f3 89 a5 52 8f 56) | (56 8f 52 a5 89 f3 61 86))}
		$LookupAccountNameA = {((78 86 32 03 d5 1e 7e 1a) | (1a 7e 1e d5 03 32 86 78))}
		$NetShareEnum = {((24 ce e4 ad f9 47 79 3c) | (3c 79 47 f9 ad e4 ce 24))}
		$IcmpSendEcho = {((5c 30 9d 03 45 29 84 87) | (87 84 29 45 03 9d 30 5c))}
		$DebugActiveProcessStop = {((04 46 57 c0 5a 43 b9 d7) | (d7 b9 43 5a c0 57 46 04))}
		$NtCreateFile = {((5d d1 b1 20 fa 8a 1a 89) | (89 1a 8a fa 20 b1 d1 5d))}
		$DecryptFileA = {((54 87 fc ae 3a 69 8d 17) | (17 8d 69 3a ae fc 87 54))}
		$GetRawInputData = {((1d 32 31 c0 f0 9f 5c f1) | (f1 5c 9f f0 c0 31 32 1d))}
		$BringWindowToTop = {((c2 be bf 3d d6 02 e9 11) | (11 e9 02 d6 3d bf be c2))}
		$NetShareSetInfo = {((67 30 3a 35 86 b5 a5 c9) | (c9 a5 b5 86 35 3a 30 67))}
		$GetLogicalDrives = {((1a 0b 48 42 c8 70 c7 2b) | (2b c7 70 c8 42 48 0b 1a))}
		$WriteFile = {((a4 ea ad 1f ba 71 8c 6c) | (6c 8c 71 ba 1f ad ea a4))}
		$BitBlt = {((b6 92 eb 36 6f b6 ae 38) | (38 ae b6 6f 36 eb 92 b6))}
		$SendMessageTimeoutA = {((7b 38 8b 85 ec 72 a1 82) | (82 a1 72 ec 85 8b 38 7b))}
		$GetCurrentProcess = {((f7 80 8a a2 55 22 9e 69) | (69 9e 22 55 a2 8a 80 f7))}
		$RegDeleteTreeA = {((70 5d 94 bc f1 ed cf 29) | (29 cf ed f1 bc 94 5d 70))}
		$CreateProcessWithTokenW = {((bd 05 80 8d cd 68 59 fe) | (fe 59 68 cd 8d 80 05 bd))}
		$FindWindowA = {((6b 75 87 c1 48 56 c0 79) | (79 c0 56 48 c1 87 75 6b))}
		$CopyFileA = {((db 79 aa 45 b1 09 2f a9) | (a9 2f 09 b1 45 aa 79 db))}
		$FtpPutFileA = {((46 41 3a de e1 61 b1 5b) | (5b b1 61 e1 de 3a 41 46))}
		$NtOpenProcess = {((a3 ba e5 4d 1e 37 04 02) | (02 04 37 1e 4d e5 ba a3))}
		$Send = {((7c e2 4d 7e 05 78 f1 63) | (63 f1 78 05 7e 4d e2 7c))}
		$EnumDeviceDrivers = {((9a df 31 eb 57 f6 1f 35) | (35 1f f6 57 eb 31 df 9a))}
		$Process32Next = {((3e ce 28 94 46 e6 19 d0) | (d0 19 e6 46 94 28 ce 3e))}
		$GetWindowDC = {((1d 07 bc 10 c0 3a 00 74) | (74 00 3a c0 10 bc 07 1d))}
		$CryptDecrypt = {((6f ec 50 1d 64 87 5c fe) | (fe 5c 87 64 1d 50 ec 6f))}
		$ReadFile = {((e6 ac 27 4b 5d 80 f0 2f) | (2f f0 80 5d 4b 27 ac e6))}
		$VirtualProtect = {((d4 1d f2 7b 94 55 6a b3) | (b3 6a 55 94 7b f2 1d d4))}
		$OpenProcess = {((cb 68 cd 53 a7 cc 4f 08) | (08 4f cc a7 53 cd 68 cb))}
		$WaitForMultipleObjectsEx = {((c8 60 12 91 5f 36 0f 36) | (36 0f 36 5f 91 12 60 c8))}
		$Inet_addr = {((87 88 05 92 56 37 7c ff) | (ff 7c 37 56 92 05 88 87))}
		$WSAStartup = {((c2 9b 08 5a a8 43 31 6b) | (6b 31 43 a8 5a 08 9b c2))}
		$Bind = {((11 1e e4 7e 59 b6 69 68) | (68 69 b6 59 7e e4 1e 11))}
		$GetTempFileNameA = {((aa af 2d a4 4c e9 5d 1f) | (1f 5d e9 4c a4 2d af aa))}
		$CreateMutexExA = {((a4 3f c7 a6 2f ad 7d 86) | (86 7d ad 2f a6 c7 3f a4))}
		$DeviceIoControl = {((6b 86 f4 1b 06 3a be ee) | (ee be 3a 06 1b f4 86 6b))}
		$CryptDestroyHash = {((9b 4a a9 7e d5 c8 a2 eb) | (eb a2 c8 d5 7e a9 4a 9b))}
		$CryptEncrypt = {((8b ba 95 33 e8 13 c5 b6) | (b6 c5 13 e8 33 95 ba 8b))}
		$NtSetContextThread = {((ac 25 71 71 03 c8 16 ca) | (ca 16 c8 03 71 71 25 ac))}
		$CryptReleaseContext = {((f9 ed 14 57 42 09 10 13) | (13 10 09 42 57 14 ed f9))}
		$StretchBlt = {((bf 39 b2 73 32 1c 30 b6) | (b6 30 1c 32 73 b2 39 bf))}
		$NtWaitForSingleObject = {((c2 f1 05 08 3a 4c 40 9c) | (9c 40 4c 3a 08 05 f1 c2))}
		$LoadLibraryExA = {((83 e1 cd 12 68 50 69 2e) | (2e 69 50 68 12 cd e1 83))}
		$PeekMessageA = {((ce 6e b8 1e 32 14 22 52) | (52 22 14 32 1e b8 6e ce))}
		$WNetAddConnectionA = {((af 29 94 6b cc 22 de a3) | (a3 de 22 cc 6b 94 29 af))}
		$NtCreateThread = {((6e 60 92 2d 75 c6 19 b3) | (b3 19 c6 75 2d 92 60 6e))}
		$ShellExecuteExA = {((cd d8 9f 74 09 42 3b c2) | (c2 3b 42 09 74 9f d8 cd))}
		$GetMessageA = {((90 4c dc 43 cf 33 f4 f1) | (f1 f4 33 cf 43 dc 4c 90))}
		$GetCurrentHwProfileA = {((9d f8 28 86 c2 9d 43 c9) | (c9 43 9d c2 86 28 f8 9d))}
		$PostThreadMessageA = {((a1 93 e1 5e 8a af 00 d5) | (d5 00 af 8a 5e e1 93 a1))}
		$RegOpenKeyExA = {((65 91 a4 0a b9 12 f8 02) | (02 f8 12 b9 0a a4 91 65))}
		$CreateWaitableTimer = {((80 a1 e4 fb b4 5e e6 c1) | (c1 e6 5e b4 fb e4 a1 80))}
		$NtSetInformationProcess = {((9c e3 c4 93 f4 72 bc ec) | (ec bc 72 f4 93 c4 e3 9c))}
		$InternetSetOptionA = {((2f 55 fd 3a 4b 62 ad ee) | (ee ad 62 4b 3a fd 55 2f))}
		$GetClipboardData = {((20 41 19 1c ce 5d 77 37) | (37 77 5d ce 1c 19 41 20))}
		$HttpSendRequestExA = {((92 b8 44 c2 c6 32 07 ea) | (ea 07 32 c6 c2 44 b8 92))}
		$CreateProcessA = {((3b 17 87 c4 48 a8 d9 75) | (75 d9 a8 48 c4 87 17 3b))}
		$CreateToolhelp32Snapshot = {((db df a5 84 ac 47 ab b5) | (b5 ab 47 ac 84 a5 df db))}
		$GetProcessHeap = {((80 86 f9 2d 74 56 1a 64) | (64 1a 56 74 2d f9 86 80))}
		$MapVirtualKeyExA = {((bd 08 8f 23 7a 7a e9 fd) | (fd e9 7a 7a 23 8f 08 bd))}
		$NtTerminateProcess = {((de 63 e5 b0 9e 3e 96 73) | (73 96 3e 9e b0 e5 63 de))}
		$CallNextHookEx = {((93 b8 f3 70 19 29 22 5c) | (5c 22 29 19 70 f3 b8 93))}
		$TerminateProcess = {((40 05 04 c0 0e 2c 33 9d) | (9d 33 2c 0e c0 04 05 40))}
		$GetIpNetTable = {((ea 1c 36 f6 5c f6 14 3f) | (3f 14 f6 5c f6 36 1c ea))}
		$SetThreadToken = {((a9 b3 7a c1 b5 a6 87 a2) | (a2 87 a6 b5 c1 7a b3 a9))}
		$SetCurrentDirectory = {((58 96 01 8f f4 6f 97 a3) | (a3 97 6f f4 8f 01 96 58))}
		$GetFileTime = {((f5 56 3b 93 f5 a4 36 1a) | (1a 36 a4 f5 93 3b 56 f5))}
		$CreateRemoteThread = {((50 b6 66 96 00 ca 7f 3b) | (3b 7f ca 00 96 66 b6 50))}
		$KeInsertQueueApc = {((fe e0 a2 b0 9e 57 18 4f) | (4f 18 57 9e b0 a2 e0 fe))}
		$SetWindowsHookExA = {((36 3b 90 c9 b5 30 e9 e9) | (e9 e9 30 b5 c9 90 3b 36))}
		$EnumWindows = {((d6 7c 61 ec 39 71 0f a9) | (a9 0f 71 39 ec 61 7c d6))}
		$NtSetSystemEnvironmentValueEx = {((3e 1d 47 db 5b 1e 77 03) | (03 77 1e 5b db 47 1d 3e))}
		$GetKeynameTextA = {((af 77 b8 d8 76 1b 33 f5) | (f5 33 1b 76 d8 b8 77 af))}
		$CryptCreateHash = {((8a d3 76 65 36 a9 c5 53) | (53 c5 a9 36 65 76 d3 8a))}
		$CreateThread = {((5e 79 0b 4c ec 0e a5 bd) | (bd a5 0e ec 4c 0b 79 5e))}
		$GetCurrentThread = {((42 ac ea bd 6d d8 9a a6) | (a6 9a d8 6d bd ea ac 42))}
		$EnumResourceTypesExA = {((1d 1a 54 ea 9c 02 25 4b) | (4b 25 02 9c ea 54 1a 1d))}
		$OpenSCManagerA = {((da 45 de 45 cb 35 b2 e9) | (e9 b2 35 cb 45 de 45 da))}
		$NtWriteVirtualMemory = {((4c 4b 73 1b 5f f3 f4 a8) | (a8 f4 f3 5f 1b 73 4b 4c))}
		$WSASocketA = {((63 19 98 f2 1e 13 68 78) | (78 68 13 1e f2 98 19 63))}
		$SetWindowLongPtrA = {((56 2a bb c8 1b fd 63 36) | (36 63 fd 1b c8 bb 2a 56))}
		$CryptAcquireContextA = {((fc ca 1e 8d 0a 0f dd bb) | (bb dd 0f 0a 8d 1e ca fc))}
		$Thread32Next = {((83 d8 66 db ee 1f cb f5) | (f5 cb 1f ee db 66 d8 83))}
		$RegisterRawInputDevices = {((ab 52 0c d9 42 21 62 b9) | (b9 62 21 42 d9 0c 52 ab))}
		$Gethostbyname = {((a7 13 2a 25 79 09 4d ff) | (ff 4d 09 79 25 2a 13 a7))}
		$GetLogicalProcessorInformationEx = {((72 2c fe ce 77 8b 6c d5) | (d5 6c 8b 77 ce fe 2c 72))}
		$CreateWindowExA = {((8b c0 84 58 0f d6 72 cb) | (cb 72 d6 0f 58 84 c0 8b))}
		$GetTickCount64 = {((c0 8e c9 1b 01 cb 5e 9f) | (9f 5e cb 01 1b c9 8e c0))}
		$SendMessageCallbackA = {((4f 29 c1 d2 85 40 a5 4a) | (4a a5 40 85 d2 c1 29 4f))}
		$WNetAddConnection2A = {((c6 86 03 2b df 40 9b 31) | (31 9b 40 df 2b 03 86 c6))}
		$ShellExecuteA = {((51 c4 6c ac 6c b7 d0 d7) | (d7 d0 b7 6c ac 6c c4 51))}
		$CryptGenRandom = {((37 dc 85 a0 cc ab 5c 26) | (26 5c ab cc a0 85 dc 37))}
		$RegConnectRegistryA = {((f5 71 38 02 c8 68 23 11) | (11 23 68 c8 02 38 71 f5))}
		$CryptBinaryToString = {((4a 20 77 1d ea 11 fa d8) | (d8 fa 11 ea 1d 77 20 4a))}
		$RtlMoveMemory = {((dd 50 80 ab 89 a4 5a 1b) | (1b 5a a4 89 ab 80 50 dd))}
		$CopyFile2 = {((db 79 aa 45 b1 09 2f da) | (da 2f 09 b1 45 aa 79 db))}
		$TimeGetTime = {((e8 97 b2 92 cc da ee 79) | (79 ee da cc 92 b2 97 e8))}
		$Thread32First = {((85 ef ad 6f 2b e4 fc 68) | (68 fc e4 2b 6f ad ef 85))}
		$PostMessageA = {((c5 20 4d e3 cf 61 f3 e9) | (e9 f3 61 cf e3 4d 20 c5))}
		$WSACleanup = {((7d f0 e3 3c 62 8a e9 24) | (24 e9 8a 62 3c e3 f0 7d))}
		$NtShutdownSystem = {((05 c0 74 cc 77 51 71 96) | (96 71 51 77 cc 74 c0 05))}
		$GetModuleFileNameA = {((91 6a 4e d1 fb 2b 83 a5) | (a5 83 2b fb d1 4e 6a 91))}
		$Socket = {((3a 8f 87 4e 31 cf 37 d2) | (d2 37 cf 31 4e 87 8f 3a))}
		$NtCreateUserProcess = {((15 fb e4 0e a8 8c 31 7d) | (7d 31 8c a8 0e e4 fb 15))}
		$GetCurrentProcessId = {((5a 21 5c c2 91 d3 fd a2) | (a2 fd d3 91 c2 5c 21 5a))}
		$InternetCloseHandle = {((73 5d 2d 5e 41 15 ff 60) | (60 ff 15 41 5e 2d 5d 73))}
		$OpenFileMappingA = {((c3 04 1f 71 f5 2f bf 5c) | (5c bf 2f f5 71 1f 04 c3))}
		$NtQueryDirectoryFile = {((6d a5 4e 2d 4c 93 96 3c) | (3c 96 93 4c 2d 4e a5 6d))}
		$GetAdaptersInfo = {((72 d8 06 a6 39 52 8e 63) | (63 8e 52 39 a6 06 d8 72))}
		$MapViewOfFile = {((dd be 24 ff 57 a2 ed 17) | (17 ed a2 57 ff 24 be dd))}
		$TerminateThread = {((f2 6a 3a 76 5e 83 f2 ea) | (ea f2 83 5e 76 3a 6a f2))}
		$ControlServiceExA = {((0b 39 de c7 a0 9d aa bf) | (bf aa 9d a0 c7 de 39 0b))}
		$CreateProcessInternal = {((e5 aa ee 28 38 ff 19 0f) | (0f 19 ff 38 28 ee aa e5))}
		$CreateMutexA = {((c1 b5 e1 61 0e 95 f2 03) | (03 f2 95 0e 61 e1 b5 c1))}
		$WSAIoctl = {((ca cc f3 ec ff 7d 2f 17) | (17 2f 7d ff ec f3 cc ca))}
		$RegOpenKeyTransactedA = {((36 56 2c 7a 47 b0 41 34) | (34 41 b0 47 7a 2c 56 36))}
		$Connect = {((7b f5 19 6f 8b 2d c7 11) | (11 c7 2d 8b 6f 19 f5 7b))}
		$RegQueryInfoKeyA = {((a7 c1 69 89 26 9f 7d 61) | (61 7d 9f 26 89 69 c1 a7))}
		$RegSetKeySecurity = {((16 5c 81 ad ac 16 4f 6a) | (6a 4f 16 ac ad 81 5c 16))}
		$NtClose = {((9a c9 83 11 bf d5 58 e1) | (e1 58 d5 bf 11 83 c9 9a))}
		$Sleep = {((ea e5 2e 23 6f 83 34 16) | (16 34 83 6f 23 2e e5 ea))}
		$NtProtectVirtualMemory = {((f1 5c 77 7c 0f 49 bc 18) | (18 bc 49 0f 7c 77 5c f1))}
		$NtReadVirtualMemory = {((8e c9 b5 30 cb b0 ef 75) | (75 ef b0 cb 30 b5 c9 8e))}
		$Gethostname = {((f3 db 15 d3 5f 78 4c a8) | (a8 4c 78 5f d3 15 db f3))}
		$CopyFileExA = {((95 08 f9 36 df 18 58 bc) | (bc 58 18 df 36 f9 08 95))}
		$Wow64SetThreadContext = {((5c 4c f5 0a fc de e3 a5) | (a5 e3 de fc 0a f5 4c 5c))}
		$EnumProcessModulesEx = {((85 da 9e 28 81 01 92 33) | (33 92 01 81 28 9e da 85))}
		$GetSystemDirectoryA = {((e2 31 0e dd 7b a7 f8 1a) | (1a f8 a7 7b dd 0e 31 e2))}
		$NtCreateProcess = {((90 dd 91 6a 27 4f a5 96) | (96 a5 4f 27 6a 91 dd 90))}
		$SetThreadContext = {((54 38 a7 e5 11 d1 6c 88) | (88 6c d1 11 e5 a7 38 54))}
		$DnsQueryEx = {((bc 87 c9 b4 c5 a9 0d d1) | (d1 0d a9 c5 b4 c9 87 bc))}
		$LoadResource = {((f0 26 ff ae 5b 20 62 51) | (51 62 20 5b ae ff 26 f0))}
		$NtAllocateVirtualMemory = {((3c 01 bd 91 32 5b 10 96) | (96 10 5b 32 91 bd 01 3c))}
		$ConnectNamedPipe = {((82 7d 97 4f a5 eb e2 88) | (88 e2 eb a5 4f 97 7d 82))}
		$RegDeleteKeyValueA = {((2d 25 5b 6b 61 a7 c6 55) | (55 c6 a7 61 6b 5b 25 2d))}
		$CreatePipe = {((1a 55 2c 59 41 d1 ed 09) | (09 ed d1 41 59 2c 55 1a))}
		$NtDelayExecution = {((e4 2d 16 30 fb 83 ee ba) | (ba ee 83 fb 30 16 2d e4))}
		$RtlGetVersion = {((7c 12 8e b5 a1 ef d0 a1) | (a1 d0 ef a1 b5 8e 12 7c))}
		$NtOpenThread = {((ca a6 a7 95 94 76 65 5f) | (5f 65 76 94 95 a7 a6 ca))}
		$RegReplaceKeyA = {((b8 2b 96 3a 6a 0d 78 b5) | (b5 78 0d 6a 3a 96 2b b8))}
		$RtlCreateHeap = {((4b 8e d9 c3 a4 a3 b4 0b) | (0b b4 a3 a4 c3 d9 8e 4b))}
		$CheckRemoteDebuggerPresent = {((f3 9e 19 cd c9 ae de 89) | (89 de ae c9 cd 19 9e f3))}
		$GetProcessIdOfThread = {((7c 3f c7 71 49 96 60 1e) | (1e 60 96 49 71 c7 3f 7c))}
		$SetForegroundWindow = {((6d fc 57 5f c8 41 c2 34) | (34 c2 41 c8 5f 57 fc 6d))}
		$SetWinEventHook = {((ec 42 cd c7 6d 35 85 b4) | (b4 85 35 6d c7 cd 42 ec))}
		$RegisterHotKey = {((48 f7 b2 64 2b fa 66 c4) | (c4 66 fa 2b 64 b2 f7 48))}
		$NtQueryInformationProcess = {((43 b6 e0 1c a9 a9 0b 4c) | (4c 0b a9 a9 1c e0 b6 43))}
		$CreateRemoteThreadEx = {((a3 bb b7 4e ad b5 49 b4) | (b4 49 b5 ad 4e b7 bb a3))}
		$OpenClipboard = {((a9 d1 91 1a 21 76 d5 49) | (49 d5 76 21 1a 91 d1 a9))}
		$RegEnumValueA = {((1b 7d 67 6d d8 d9 88 c2) | (c2 88 d9 d8 6d 67 7d 1b))}
		$URLDownloadToCacheFile = {((7c 61 b0 4d db 5d 8d ad) | (ad 8d 5d db 4d b0 61 7c))}
		$LocalAlloc = {((6b 6f 24 b6 f3 db e2 05) | (05 e2 db f3 b6 24 6f 6b))}
		$ShowWindow = {((48 03 18 52 56 d2 0f 0a) | (0a 0f d2 56 52 18 03 48))}
		$VirtualQueryEx = {((e8 8c 5a d9 6e bb 86 b1) | (b1 86 bb 6e d9 5a 8c e8))}
		$NtQueueApcThread = {((1a 18 83 8f b8 71 85 16) | (16 85 71 b8 8f 83 18 1a))}
		$NtMakeTemporaryObject = {((e2 05 9f 75 2b b2 18 2f) | (2f 18 b2 2b 75 9f 05 e2))}
		$VirtualAllocExNuma = {((ff 50 81 2f 7d d3 45 4f) | (4f 45 d3 7d 2f 81 50 ff))}
		$RegOpenKeyA = {((a4 bc ce 09 c1 cf bd 17) | (17 bd cf c1 09 ce bc a4))}
		$EnumDesktopWindows = {((b3 a7 40 8a 81 ff ba e1) | (e1 ba ff 81 8a 40 a7 b3))}
		$WaitForSingleObject = {((a1 1d 60 21 39 91 85 5a) | (5a 85 91 39 21 60 1d a1))}
		$FindResourceExA = {((10 d0 1b d2 b4 f5 bd cc) | (cc bd f5 b4 d2 1b d0 10))}
		$CryptStringToBinary = {((94 3e f7 28 51 b7 9f 60) | (60 9f b7 51 28 f7 3e 94))}
		$RegEnumKeyA = {((48 ce da 18 25 38 b1 50) | (50 b1 38 25 18 da ce 48))}
		$Select = {((59 0b 17 fb 08 d2 d5 f5) | (f5 d5 d2 08 fb 17 0b 59))}
		$WNetEnumResourceA = {((48 5a 92 08 8f 1c e4 53) | (53 e4 1c 8f 08 92 5a 48))}
		$EnumProcesses = {((5f 65 e4 60 54 4f 1c 89) | (89 1c 4f 54 60 e4 65 5f))}
		$Listen = {((d9 b1 53 05 ad 84 97 48) | (48 97 84 ad 05 53 b1 d9))}
		$RegCreateKeyA = {((0b 37 9d b7 1c ec 7b cb) | (cb 7b ec 1c b7 9d 37 0b))}
		$IsDebuggerPresent = {((57 25 de a0 1c b7 d7 b5) | (b5 d7 b7 1c a0 de 25 57))}
		$FindNextUrlCacheEntryA = {((a0 d4 d4 6e 9c ad 33 59) | (59 33 ad 9c 6e d4 d4 a0))}
		$StartServiceA = {((2d 45 de c6 e9 f3 4a 55) | (55 4a f3 e9 c6 de 45 2d))}
		$GetThreadContext = {((f6 61 8b b8 04 42 b4 8c) | (8c b4 42 04 b8 8b 61 f6))}
		$VirtualAlloc = {((5e f8 84 7c 15 d5 5c d9) | (d9 5c d5 15 7c 84 f8 5e))}
		$Module32First = {((31 df da af 86 14 35 64) | (64 35 14 86 af da df 31))}
		$FindFirstUrlCacheEntryA = {((17 eb 16 f6 d3 c1 42 50) | (50 42 c1 d3 f6 16 eb 17))}
		$SleepEx = {((15 e7 37 94 9b 5e 75 3d) | (3d 75 5e 9b 94 37 e7 15))}
		$MoveFileA = {((87 13 24 84 25 19 f2 d1) | (d1 f2 19 25 84 24 13 87))}
		$NtSetValueKey = {((5a e8 76 b7 df b8 da b5) | (b5 da b8 df b7 76 e8 5a))}
		$SetWindowLongA = {((74 58 18 1e fe 67 f6 7a) | (7a f6 67 fe 1e 18 58 74))}
		$MapViewOfFileEx = {((19 fd 6b e0 5b 81 c1 88) | (88 c1 81 5b e0 6b fd 19))}
		$NtDuplicateObject = {((7d 39 c3 96 81 cc b4 87) | (87 b4 cc 81 96 c3 39 7d))}
		$GetKeyboardState = {((9d 74 b9 1e 42 e0 bc 27) | (27 bc e0 42 1e b9 74 9d))}
		$GetSystemTime = {((2b 12 30 b6 76 98 06 ab) | (ab 06 98 76 b6 30 12 2b))}
		$FindWindowExA = {((4e de 37 c7 03 8d 30 ec) | (ec 30 8d 03 c7 37 de 4e))}
		$RegQueryMultipleValuesA = {((fc 56 6a 40 6c 6d ba 12) | (12 ba 6d 6c 40 6a 56 fc))}
		$DrawTextExA = {((26 41 dd 00 32 4a 27 32) | (32 27 4a 32 00 dd 41 26))}
		$RegEnumKeyExA = {((73 58 21 50 9d f9 f0 4d) | (4d f0 f9 9d 50 21 58 73))}
		$QueueUserAPC = {((c0 12 64 0a 8e 53 d4 1b) | (1b d4 53 8e 0a 64 12 c0))}
		$RegSaveKeyA = {((3a 16 09 08 92 25 49 a4) | (a4 49 25 92 08 09 16 3a))}
		$CreateFileMappingA = {((ac 24 8f 49 e0 40 c3 38) | (38 c3 40 e0 49 8f 24 ac))}
		$CryptDestroyKey = {((a2 48 ee c7 34 e0 67 24) | (24 67 e0 34 c7 ee 48 a2))}
		$RegDeleteKeyExA = {((99 37 84 ef 14 d3 c9 c3) | (c3 c9 d3 14 ef 84 37 99))}
		$EnumResourceTypesA = {((f1 1f 8f 01 5b 00 b4 76) | (76 b4 00 5b 01 8f 1f f1))}
		$RegSetKeyValueA = {((f3 1b 0c fc 7a b0 01 38) | (38 01 b0 7a fc 0c 1b f3))}
		$timeSetEvent = {((ee 38 26 c0 7c a1 27 96) | (96 27 a1 7c c0 26 38 ee))}
		$RegSaveKeyExA = {((a1 d0 a8 41 0b 81 30 09) | (09 30 81 0b 41 a8 d0 a1))}
		$CountClipboardFormats = {((dd 10 0d d5 7d 14 b4 20) | (20 b4 14 7d d5 0d 10 dd))}
		$HttpAddRequestHeaders = {((7e c2 54 5c 5c 40 30 7d) | (7d 30 40 5c 5c 54 c2 7e))}
		$NtQueueApcThreadEx2 = {((cc 28 b6 84 44 0f 51 95) | (95 51 0f 44 84 b6 28 cc))}
		$RegCopyTreeA = {((87 9c 0f 29 0e 65 02 47) | (47 02 65 0e 29 0f 9c 87))}
		$ImpersonateLoggedOnUser = {((be 76 71 f2 11 8e 53 44) | (44 53 8e 11 f2 71 76 be))}
		$GetDriveTypeA = {((99 c3 9c 6d f4 f8 42 b2) | (b2 42 f8 f4 6d 9c c3 99))}
		$GetVersionExA = {((52 08 19 bc a6 5a b7 3f) | (3f b7 5a a6 bc 19 08 52))}
		$InternetReadFile = {((6e f8 c5 b0 e8 10 ad ec) | (ec ad 10 e8 b0 c5 f8 6e))}
		$RegOpenCurrentUser = {((1c ca 4e 94 1f f4 26 d1) | (d1 26 f4 1f 94 4e ca 1c))}
		$GetThreadLocale = {((c8 7c 15 5e 8a 5d f2 35) | (35 f2 5d 8a 5e 15 7c c8))}
		$NtUnmapViewOfSection = {((2a 55 56 16 e0 27 7b 8d) | (8d 7b 27 e0 16 56 55 2a))}
		$FindNextFileA = {((92 e9 9f b5 40 46 03 5a) | (5a 03 46 40 b5 9f e9 92))}
		$GetLogicalProcessorInformation = {((dc 06 51 87 43 41 05 3e) | (3e 05 41 43 87 51 06 dc))}
		$FlushEfsCache = {((de 2b c0 ef f3 7a 02 9f) | (9f 02 7a f3 ef c0 2b de))}
		$Closesocket = {((fe 7c 2c 68 36 22 95 04) | (04 95 22 36 68 2c 7c fe))}
		$NetShareGetInfo = {((f7 80 08 01 26 7e 3b 75) | (75 3b 7e 26 01 08 80 f7))}
		$GetModuleHandleA = {((0a 88 30 15 26 72 66 ee) | (ee 66 72 26 15 30 88 0a))}
		$VirtualAlloc2FromApp = {((37 f1 a5 fd 22 b2 44 36) | (36 44 b2 22 fd a5 f1 37))}
		$MoveFileExA = {((13 b9 d6 43 d9 24 2d d4) | (d4 2d 24 d9 43 d6 b9 13))}
		$NtWaitForMultipleObjects = {((76 b6 ac 42 dc 48 ca 83) | (83 ca 48 dc 42 ac b6 76))}
		$DeleteFileA = {((6b e4 74 f4 a0 40 d6 cb) | (cb d6 40 a0 f4 74 e4 6b))}
		$StartServiceCtrlDispatcherA = {((6c 99 e0 66 3c 79 a2 71) | (71 a2 79 3c 66 e0 99 6c))}
		$HttpOpenRequestA = {((aa 8c 3b 0e 98 bc 41 4d) | (4d 41 bc 98 0e 3b 8c aa))}
		$GetThreadInformation = {((76 11 51 ae 6e 59 e8 6f) | (6f e8 59 6e ae 51 11 76))}
		$NtDeleteKey = {((8b 2a fe a8 82 3c 94 ab) | (ab 94 3c 82 a8 fe 2a 8b))}
		$InternetWriteFile = {((3a 27 77 70 79 6f 72 11) | (11 72 6f 79 70 77 27 3a))}
		$LoadLibraryA = {((9a c1 70 05 aa 25 77 9b) | (9b 77 25 aa 05 70 c1 9a))}
		$RegQueryValueExA = {((25 90 67 cf ba c4 5a 7a) | (7a 5a c4 ba cf 67 90 25))}
		$NtCreateProcessEx = {((7a fd 42 7b 36 c1 22 bd) | (bd 22 c1 36 7b 42 fd 7a))}
		$GetForegroundWindow = {((36 a7 02 ed 4d 35 4d 28) | (28 4d 35 4d ed 02 a7 36))}
		$NtQuerySystemEnvironmentValueEx = {((82 2e 76 a4 0d 24 d8 e3) | (e3 d8 24 0d a4 76 2e 82))}
		$SizeOfResource = {((e5 38 4c a1 f1 d2 a7 21) | (21 a7 d2 f1 a1 4c 38 e5))}
		$RegGetValueA = {((ce cf dd dd 0e 3a ab 53) | (53 ab 3a 0e dd dd cf ce))}
		$LdrLoadDll = {((05 cc 9d 07 66 99 19 53) | (53 19 99 66 07 9d cc 05))}
		$NtResumeThread = {((83 59 30 92 17 74 70 6a) | (6a 70 74 17 92 30 59 83))}
		$MapViewOfFile3 = {((6d 05 f4 e1 e9 d8 de 26) | (26 de d8 e9 e1 f4 05 6d))}
		$NtQueryTimer = {((0b bd 0b 43 70 31 ef 78) | (78 ef 31 70 43 0b bd 0b))}
		$RtlCopyMemory = {((10 40 cc 9b 04 1f 2a 63) | (63 2a 1f 04 9b cc 40 10))}
		$InternetConnectA = {((fd 4d 62 c1 0a 80 a3 39) | (39 a3 80 0a c1 62 4d fd))}
		$SetClipboardData = {((2a a9 f5 d0 5f bc 90 bb) | (bb 90 bc 5f d0 f5 a9 2a))}
		$GetKeyState = {((4d b0 89 b5 bf d8 f7 67) | (67 f7 d8 bf b5 89 b0 4d))}
		$WriteProcessMemory = {((ea 80 11 f5 2f f9 c5 f8) | (f8 c5 f9 2f f5 11 80 ea))}
		$RtlSetProcessIsCritical = {((01 53 b7 b8 15 bc e1 a9) | (a9 e1 bc 15 b8 b7 53 01))}
		$NetShareAdd = {((17 b2 38 d1 51 bd 71 b0) | (b0 71 bd 51 d1 38 b2 17))}
		$NtResumeProcess = {((76 8e b5 db 4e d1 74 1d) | (1d 74 d1 4e db b5 8e 76))}
		$GetProcessHeaps = {((bb 73 cc 3c ae 4e d7 9f) | (9f d7 4e ae 3c cc 73 bb))}
		$RegDeleteKeyTransactedA = {((bb 1a b1 a9 cc 2f d8 39) | (39 d8 2f cc a9 b1 1a bb))}
		$ReadProcessMemory = {((1a 62 cf af 81 aa e6 d9) | (d9 e6 aa 81 af cf 62 1a))}
		$GetNativeSystemInfo = {((7b 7e 00 33 aa 09 fa 29) | (29 fa 09 aa 33 00 7e 7b))}
		$ioctlsocket = {((e6 14 77 4b d6 e5 29 5f) | (5f 29 e5 d6 4b 77 14 e6))}
		$CreateProcessAsUserA = {((ca fd 18 2d 07 cf 66 96) | (96 66 cf 07 2d 18 fd ca))}
		$PeekNamedPipe = {((e7 de 91 53 ea ca b3 ff) | (ff b3 ca ea 53 91 de e7))}
		$SuspendThread = {((94 d1 94 05 47 a2 1b cb) | (cb 1b a2 47 05 94 d1 94))}
		$CallWindowProcA = {((3e 48 45 92 3d d4 b4 9e) | (9e b4 d4 3d 92 45 48 3e))}
		$OpenServiceA = {((a1 ff 05 7b 82 5a 45 67) | (67 45 5a 82 7b 05 ff a1))}
		$SetTimer = {((5a 46 fa 74 f8 61 c4 96) | (96 c4 61 f8 74 fa 46 5a))}
		$MapViewOfFile2 = {((6d 05 f4 e1 e9 d8 de 27) | (27 de d8 e9 e1 f4 05 6d))}
		$RegRestoreKeyA = {((1d f4 b3 ce c1 0e 93 8b) | (8b 93 0e c1 ce b3 f4 1d))}
		$InternetOpenUrlA = {((7a 6b e1 65 bd 90 6a aa) | (aa 6a 90 bd 65 e1 6b 7a))}
		$GetTempPathA = {((de 3c 56 29 cf 6d 1c 85) | (85 1c 6d cf 29 56 3c de))}
		$NtAdjustPrivilegesToken = {((47 1f 32 44 46 aa a5 11) | (11 a5 aa 46 44 32 1f 47))}
		$GetTickCount = {((e4 1e 1f 13 94 f2 8a e5) | (e5 8a f2 94 13 1f 1e e4))}
		$RegSetValueExA = {((92 4b 24 34 5b 49 ab ca) | (ca ab 49 5b 34 24 4b 92))}
		$NtCreateSection = {((8f c5 e5 f0 be 45 14 dc) | (dc 14 45 be f0 e5 c5 8f))}
		$SetPropA = {((c1 65 fc 93 fe fb 80 39) | (39 80 fb fe 93 fc 65 c1))}
		$GetModuleFileNameExA = {((0c e4 45 af d6 f2 6d 10) | (10 6d f2 d6 af 45 e4 0c))}
		$PathFileExistsA = {((10 38 21 cd ff 22 91 f7) | (f7 91 22 ff cd 21 38 10))}
		$SetFocus = {((18 dc 6f fe d5 c5 d1 c1) | (c1 d1 c5 d5 fe 6f dc 18))}
		$GetDCEx = {((c3 a1 9d b3 bf 0f f4 f3) | (f3 f4 0f bf b3 9d a1 c3))}
		$WNetOpenEnumA = {((c0 49 d2 17 25 f3 32 17) | (17 32 f3 25 17 d2 49 c0))}
		$FindFirstFileA = {((dd 21 ac fc 21 10 ee 9d) | (9d ee 10 21 fc ac 21 dd))}
		$AttachThreadInput = {((da 79 db ef dd 7c 99 26) | (26 99 7c dd ef db 79 da))}
		$AdjustTokenPrivileges = {((a5 63 4d 71 99 01 c5 ff) | (ff c5 01 99 71 4d 63 a5))}
		$EnumProcessModules = {((b1 75 d5 c5 79 15 2b 84) | (84 2b 15 79 c5 d5 75 b1))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c3dc53c6-af2f-4611-a5ea-57b87e56cb8e
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
