_Trojan_Autorun_Trojan_GenericKDZ_94847_123_1_Trojan_Autorun_Tro_192

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_123_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_162_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_18_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_208_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_273_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_291_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_318_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_334_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_370_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_374_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_385_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_391_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_395_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_405_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_439_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_43_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_469_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_472_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_481_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_59_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_9_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94942_1.vir, Trojan.Autorun_Trojan.GenericKDZ.95048_3_1.vir, Trojan.Autorun_Win32.Neshta.A_2_1.vir, Trojan.Autorun_Worm.Generic.377591_3.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_12_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_57_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_76_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_102_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_112_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_133_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_135_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_151_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_152_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_161_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_168_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_16_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_234_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_241_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_245_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_269_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_26_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_271_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_278_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_281_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_285_1.vir, Virus.Danger_Trojan.Agent.DQQO_20.vir, Virus.Danger_Trojan.Agent.DQQO_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_5.vir, Virus.Hijack_Trojan.Agent.DQQO_114.vir, Virus.Hijack_Trojan.Agent.DQQO_119.vir, Virus.Hijack_Trojan.Agent.DQQO_122.vir, Virus.Hijack_Trojan.Agent.DQQO_125.vir, Virus.Hijack_Trojan.Agent.DQQO_181.vir, Virus.Hijack_Trojan.Agent.DQQO_183.vir, Virus.Hijack_Trojan.Agent.DQQO_202.vir, Virus.Hijack_Trojan.Agent.DQQO_203.vir, Virus.Hijack_Trojan.Agent.DQQO_220.vir, Virus.Hijack_Trojan.Agent.DQQO_233.vir, Virus.Hijack_Trojan.Agent.DQQO_235.vir, Virus.Hijack_Trojan.Agent.DQQO_255.vir, Virus.Hijack_Trojan.Agent.DQQO_257.vir, Virus.Hijack_Trojan.Agent.DQQO_283.vir, Virus.Hijack_Trojan.Agent.DQQO_332.vir, Virus.Hijack_Trojan.Agent.DQQO_357.vir, Virus.Hijack_Trojan.Agent.DQQO_359.vir, Virus.Hijack_Trojan.Agent.DQQO_407.vir, Virus.Hijack_Trojan.Agent.DQQO_409.vir, Virus.Hijack_Trojan.Agent.DQQO_58.vir, Virus.Hijack_Trojan.Agent.DQQO_79.vir, Virus.Hijack_Trojan.Agent.DQQO_85.vir, Virus.Hijack_Trojan.Agent.DQQO_98.vir, Virus.Hijack_Trojan.Agent.DQQO_99.vir

import "pe"
rule _Trojan_Autorun_Trojan_GenericKDZ_94847_123_1_Trojan_Autorun_Tro_192 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_123_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_162_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_18_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_208_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_273_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_291_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_318_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_334_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_370_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_374_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_385_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_391_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_395_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_405_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_439_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_43_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_469_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_472_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_481_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_59_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_9_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94942_1.vir, Trojan.Autorun_Trojan.GenericKDZ.95048_3_1.vir, Trojan.Autorun_Win32.Neshta.A_2_1.vir, Trojan.Autorun_Worm.Generic.377591_3.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_12_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_57_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_76_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_102_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_112_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_133_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_135_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_151_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_152_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_161_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_168_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_16_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_234_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_241_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_245_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_269_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_26_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_271_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_278_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_281_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_285_1.vir, Virus.Danger_Trojan.Agent.DQQO_20.vir, Virus.Danger_Trojan.Agent.DQQO_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.CuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_5.vir, Virus.Hijack_Trojan.Agent.DQQO_114.vir, Virus.Hijack_Trojan.Agent.DQQO_119.vir, Virus.Hijack_Trojan.Agent.DQQO_122.vir, Virus.Hijack_Trojan.Agent.DQQO_125.vir, Virus.Hijack_Trojan.Agent.DQQO_181.vir, Virus.Hijack_Trojan.Agent.DQQO_183.vir, Virus.Hijack_Trojan.Agent.DQQO_202.vir, Virus.Hijack_Trojan.Agent.DQQO_203.vir, Virus.Hijack_Trojan.Agent.DQQO_220.vir, Virus.Hijack_Trojan.Agent.DQQO_233.vir, Virus.Hijack_Trojan.Agent.DQQO_235.vir, Virus.Hijack_Trojan.Agent.DQQO_255.vir, Virus.Hijack_Trojan.Agent.DQQO_257.vir, Virus.Hijack_Trojan.Agent.DQQO_283.vir, Virus.Hijack_Trojan.Agent.DQQO_332.vir, Virus.Hijack_Trojan.Agent.DQQO_357.vir, Virus.Hijack_Trojan.Agent.DQQO_359.vir, Virus.Hijack_Trojan.Agent.DQQO_407.vir, Virus.Hijack_Trojan.Agent.DQQO_409.vir, Virus.Hijack_Trojan.Agent.DQQO_58.vir, Virus.Hijack_Trojan.Agent.DQQO_79.vir, Virus.Hijack_Trojan.Agent.DQQO_85.vir, Virus.Hijack_Trojan.Agent.DQQO_98.vir, Virus.Hijack_Trojan.Agent.DQQO_99.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "ef555bd1424f76a89f30e7f593e6c26d032cf225c5a8ee539d95ef12673108e7"
    hash2       = "239133dbfa6e58c8d513a450b6059420af9df1b70cc75b8f47df7da571e6328d"
    hash3       = "b35dd7e8738774b258c6a5d49076e9944c73fa8afdb96903c3ccd222da1c473d"
    hash4       = "23e48f2e09923ebfa41d143384520d0491c03091f4c7d362f76600a647d45e4c"
    hash5       = "4efb9641ba55d78520128d558f9704dd2137cdf78d6b5a7c5c8bf08391667c4a"
    hash6       = "9fcd9b2aafa54bc451284e631fcdf83b6fb44d2f1393b8cfd584a25eac14a2b4"
    hash7       = "01dae561c88e8041c5999e8154122483e72374137659fb2a31b9a6ec441923d6"
    hash8       = "125e91ecd82bf889d99d1dffaa70586a50969a820a6308ec63d33926a397d69b"
    hash9       = "484e8d49f5dff233072297436a9cd001c5f0ffe77655a882bcbdadd6a5fee61e"
    hash10      = "95b0277605036159517a7ed9962f71fbd83386a98b7c2cf85f240d74e9daa8e3"
    hash11      = "c132c68b1994934218fe722a9807988c0412fb97e2175a0a02dada1e9bf9cc16"
    hash12      = "967859ac038dd4a46f95972c1c967010d37a83922d71db78feaccbbadeb78c9d"
    hash13      = "6fe4e3732dbcaa0f017fc4c41350a455d93efb07d3dd8981cf89edaf07578a7b"
    hash14      = "0c8617fe04db54eed3c5e8a7820fc6a940a840727f072692b2683e32dd3eddb1"
    hash15      = "9c59a834b326ffb34dbb3c45dafd89e53e7a037f6589d1bbe9c47d0ed8a90dcd"
    hash16      = "b5ed2742c2a235327060cb943552c451fc4254fd9344c0999e353e429e5030e2"
    hash17      = "d0c0b657620852b01fd4101362d5ead965d80e4bc4b937767dfa0e35bc17a4f8"
    hash18      = "fd1abb2ec48dca5a559c2785cb536f1a62b9123286a18cbd057f9a4cad2c0103"
    hash19      = "96a38a5e169bb6d6565865c3146767fb82a42f26e2efb8c0babf9429e8d5abd6"
    hash20      = "04babcb3d1f3e349fac6833b2478d60419197c93da0ed9e8ce1c402ce793eb0f"
    hash21      = "46f8de4aa1009e0c65ab30826ec3fef5a39f818c6180f4649320e98f32e6fd3c"
    hash22      = "693a522ae869eba5d25fb6d5386c9fac3cb5841302fa2646bb7954c4c0ece15f"
    hash23      = "369b570919a6c2c95333bde8943bec02700d1b952211e0e648e0f1c61c15a882"
    hash24      = "27e6192a8589eeb8bb079f5b6af121be2fba3a8a0e1a63fcd9a36cb8892720c8"
    hash25      = "c6ab76a447f93bfdf37ca6fc2f3a4448f488217db8282b694b4c2faf252d4cbb"
    hash26      = "e35a05b32b5954de7ae1cc7d7aa335c131163d0bc4c4a0ead18d1f3ab764a431"
    hash27      = "08b80ccc8456e3867f0422d72d3bfc77befef53f117f2d9568a9a2f2ea33e24c"
    hash28      = "27abe658a09aec3ee878507f40983256d9115edc563839a13fa6b148107ec09a"
    hash29      = "92f796d0b907276a5247c6f542298c761e0041e3e7472736e64b8907abf502f5"
    hash30      = "4ecc6646cf31e608ccef61f47a0ba4abe2657525e10590c2d52dbcfa263493bc"
    hash31      = "7415d76cdbc8420e53d6aef8ed06bf830b20a25d8bc1d25ec8b3ebee39dda76e"
    hash32      = "cddbea5b2e9f5909c2e446f6e0c6558c91c64978ec3b0f6dac6f0fb96cebd2e0"
    hash33      = "127aaff63b5f47afd896c503475e82c38f531324a21fd846b383f5df2ddec20b"
    hash34      = "9db147f417245f630134f477fcfd35885abb11f376ba325620f9785233add56d"
    hash35      = "22a956b852dc53e1307a52d66b526790fc6184d25eeffe46b0633db83fd46792"
    hash36      = "5c1835307ea852a7dafcd59473bbd696f25210058b2c9cfcb6c5d61f63b95b45"
    hash37      = "6497ac86163aff0113dbaa07e89072172fd32f944756f781b1fab6e3af6c65c7"
    hash38      = "9d93a3b2e679c315f883cf21808b83ce0ab4b9a8fc3af8eff86d52eee1f6692b"
    hash39      = "155f458a87aab1b85e7eae09ef91960910a7944f6b2116e50155cbd7061e36ae"
    hash40      = "e975847fe7c7dfe46369a8851b374efeee02a66616d53a3d2c93e156b78b01e0"
    hash41      = "1cbfd95f011122b8595121f55f02325bf15644a00d25eea4455e238ff6911d52"
    hash42      = "e8661133efc23d5a57796f3ff39e1f6c3dba17b6cbe928567136d7f1fcb61ee8"
    hash43      = "7a920cf6e33944cc302a8e898e85d46c5842a64b478c035365483b8548cadb98"
    hash44      = "1b205428cb543d7e42906b63e82d92d7100a82448320167b967382b31a4719e8"
    hash45      = "f4b3337ced5e023e8df572c9c89dd22d3876eb76bbdaae4f8879801761f1bd7e"
    hash46      = "76b92573b682c41a86a407063826e3f700fe1b717ccf2b44cf308cb76aa037f4"
    hash47      = "16ec30cbc6e2fd91ae38a669bba5da3ed9c0174211a917c3a7b8b76fb638740f"
    hash48      = "e026ae2fecae62ca40c7286a36a4443058d0756143a72e77ac4ebdd42c1e5617"
    hash49      = "e24d62113d8eabce735fab62bafba629ef4acf5412201f780f25f14b5b538345"
    hash50      = "5ccca101e4b58b3705c8942574fc35f5a952f99ed8fc0684f17859bd2da428e7"
    hash51      = "ba22cc5d337f95214952a1c9fae50cbc2e26115fd0240868bb7b1ff11107e7e3"
    hash52      = "fa72296a0e9e02dca2595aa9de6a07046bca49ea91d71ba1542a5a466f3b1884"
    hash53      = "4b2e650efd6e3cd89601c954e8d4acf34d9696e9dc8b0d8e27cfebcdb8c3f72a"
    hash54      = "3142d9ba34334e68adbde1ca843ac91ec0bf2dc6d052866999b096e1d9cde8e8"
    hash55      = "36182252100335b01b2709a31f1497e3277955ffc014fee047c2376bdb31e6d0"
    hash56      = "7a111049bbd3c574880cb1f534ba07f051397106f42e77b7f938e06919ee37a1"
    hash57      = "183126c2c8bf237c910a3110fd02d0143e1ac527e615109155f1af4f80fc97e7"
    hash58      = "c066442eaaec047cb6dbf36692ce2ccc5d9baf99bcdab1d9c6f8b5d061a88b60"
    hash59      = "e31ee94f6df02c4f00174a81ef5f66973de26e9c019cd846f8fd2ad419fc5744"
    hash60      = "f7dbecc7e36c1b46078f9fe6e424a50b0290f24aa01627e4015d54ed0ca76a69"
    hash61      = "4a1c64e1af279bb586187857e8f1de9ff77736f9c924e13b0431df070bc6a8fd"
    hash62      = "ce532e58de93dc4cf9ebd30e2149af804ffc6fc1f0fec7bcc1be6a62cbc32be9"
    hash63      = "cd588e6639c117a13e8da325e477505f3c7dd57ed5f38ed820a950cc24114d27"
    hash64      = "6305e9896a2317d114ed42b2177f8d1015f769c1f73a780558ac60c216d311f4"
    hash65      = "4875c86e67fadc4f42f251bcda5766ce0282f9192c199e62008205c8b5c1cb83"
    hash66      = "a449f3c38ae638a246c566f6eba7ee5cc9f319c318ba0241eca55b43a7f1b1f9"
    hash67      = "8b0b1eaa4249c20ec02641b7cff38ea05dc05a59588377da0428dfd7b0edca42"
    hash68      = "7fba97ac67fd073d4d7a441030e337e2a602a57715e7a208e0a2928024b7a535"
    hash69      = "33219ac0e926d4897645c86d8d17e3771bf97d3142fa0cb4df76a6d5235b2352"
    hash70      = "cf4efc4ede860b0ff6f75f820670fbbc229ab3f2dcc718ac78415200bc1fa393"
    hash71      = "6513d38d6248a378fb2dd8f13fa4a0f058c215a717a3c5cc2f70633a9e335a30"
    hash72      = "d0540c878eb8a82f43db2b4c44dd0b64abd62a9780b94f04daae7145316703f1"
    hash73      = "3790c33315e5364412c66fabdc69ca2b78a2affd1806fbb722277904d255263d"
    hash74      = "fe345d216acb5725040c9aba44b73cc90e32610bd8c1ad693609044626c5703f"
    hash75      = "b96899e7e7197a0b23810b683a9c13e3d01e086f9cb58df3dfe072dfb94f70ac"
    hash76      = "46dd41d1bd259ae8071e7abfdc7117f6baa0089495a0e090b59653e5331130c6"
    hash77      = "01ac396070ee16b9679c29341339979e831a4722a56d0193ae3ffead1fd0f4aa"
    hash78      = "55c8e0e566730a190205da20f5d6fb310b23ecd0603d98f0bb13d29ff974c37f"
    hash79      = "dddc4bbff25819283c56f272e896187be2071a3f0f097abf0cf8e23c376d667c"
    hash80      = "b7844f99226b78f3690cc0d62b2f7074e395fb00754e5599f42ff561b71a847c"
    hash81      = "dbad7136bd24d6427a579db49cdcaa2834fe99ff7eb422271878a3cc5650d2cf"
    hash82      = "cd5abf626c6ba9b54471bd9a3902eddd81d0feb21e697b86f3edcb849f55eb65"
    hash83      = "725c030a02b7c7df60ea995bb164c762387ebc1406150b55af5fbacd57806dc4"
    hash84      = "e82a9f133be72c6f228983dbbd78c0dce0b585fd155778b6a27760ba9a834a58"
    hash85      = "cce0b3c87d97f20e22451ed2bb4dda6380bf24c3cee350ea06070122b7c1ae5f"
    hash86      = "902171d29bf8ad05304fc9eb163cac0a32d5e9441c500a78aac67d84ca6fff62"
    hash87      = "3d9b5502c7d950ffb15beae9eb9692f77269c3fef0fca2ddf08005ee00a7098d"
    hash88      = "eb09ca2b2d41d91d24fa093cd59c3d6262e393dc60be3d3e3f37052f6d4f5254"
    hash89      = "2668dd4b8b457506e748717539feddc5244973b457e7790de6c43709756a895b"
    hash90      = "a72cb81869da922edefca53d3dad0619c71258e44ea9cde63fbaf6c00619aa27"
    hash91      = "4d7c14b026a0bcdd9372cf1213245dd6d86f3da0232a91fd4b90bf8af7ec7fd5"
    hash92      = "8f62a3878f8791e12707a819ec3f91faedf390f410d8e68ea8569c0385959d95"
    hash93      = "febcf9959ff841625e09b5bc856a5fc1b058a0fa229effccb1327dddf94b727d"
    hash94      = "9a3e6271d20a6525c19df2e563a9ebe2689c2310c8cf2b119756c865b2dae3b4"
    hash95      = "f5069e8aba924b2b69252f4e0014dbdf51b8f6887e3490c22945fc524bdacbbc"
    hash96      = "7450d33533da665e550c08452c64c1f3c636d9c6d8542d4f8f3e91465a5465c5"
    hash97      = "cd5f902e67756a1e945d992468aa4933b97a12526432edebd4070a956ceaf501"
    hash98      = "09f1da0a1ee0de8bf7089f0edba20eb0cbb8f8c44630b351cffe31a871aab79c"
    hash99      = "1c79465323c38a35c4c997b99ee1bf33676dacd422487488c3ea1dec72e5eb5b"
    hash100     = "bb506c5a6edd3d4fe47042c958349c4f264a1cb1a3c187252e9899d9e7985c85"
    hash101     = "b4d106e46a27214d7caf39d767750755dc5dd40680950d4bcec5b606a2227d55"
    hash102     = "6c3e89a874bc77e095be82a2a2019b3a262d2aaf8d66db5e96d84006dbe52a82"
    hash103     = "1520cd832b4212bef30b3073ffbc0f1d11ad4c03e32c9fed14e6b315c565a62c"
    hash104     = "bfb722ffd7856290167a2b5ca9ccb44ed0854c68088bb9083bed9ba872bb9a9e"
    hash105     = "25cde2f239745f83013e442a92129f1cb90cfe0ba63c133d118c2a30c5e27818"
    hash106     = "9e3464ca8800c758553fcacc335b3a53c96ef8c7c02c925d8fac5b3956ef4dd6"
    hash107     = "e9519712ef7bbfcdbf4823eac4d5060eb40ea160bf9cb0c7dad885c79234257a"
    hash108     = "71db72aa08c4a9b02ac3e73f428a199fe25e72f8d2d60efed92f56963dfd38fb"
    hash109     = "e5cf79e8c5db6f4b257e59413e982e4a39f29213bbaf67c95ec3bc4e51282c6c"
    hash110     = "32cbf87834073f453d3b9688c6bc7d56bda941f890837a0270cf777c6b876e5a"
    hash111     = "dfeb3a3f776f401d2475d1fc105dea800cee16655e6d2bc5b4bcee5db6e0a985"
    hash112     = "22cd1c69ba5541e5f40fa74c6c241fd58dfcc950cf0b5e19143d677dd7ddbf56"
    hash113     = "99490f0555acc3cf1616d87310a50733dcf607c51831a817ec3ab8c059587252"
    hash114     = "a8e8883c5169c9a21dd6ef5687c42d1fc44e40c4d5d1425b01fb279099cbe335"

  strings:
    $s1  = "<toast launch=\"App Installer\" duration =\"short\"><visual><binding template = \"ToastGeneric\"><text>%s</text></binding></visu" wide
    $s2  = "ProgressReporter -> Download Progress" fullword wide
    $s3  = "Ready to install App -> Download Success" fullword wide
    $s4  = "Installation Status -> Newer version of the App is already installed" fullword wide
    $s5  = "Installation Status -> Older version of the App is already installed" fullword wide
    $s6  = "Concurrency.details.?$_IAsyncOperationWithProgressToAsyncOperationConverter@P$AAUIInputStream@Streams@Storage@Windows@@_K" fullword wide
    $s7  = "Package Dependency -> Framework is required to be installed" fullword wide
    $s8  = "ProgressReporter -> Main App Progress" fullword wide
    $s9  = "Installation Status -> App is already installed" fullword wide
    $s10 = "Switch download view to install view." fullword wide
    $s11 = "Package Dependency->BigId from PFAN, HTTP Status Code: " fullword wide
    $s12 = "mainContentContainer height: " fullword wide
    $s13 = "bottomContentContainer height: " fullword wide
    $s14 = "PackageDependencyInstaller -> Missing Dependency Packages count: " fullword wide
    $s15 = "Package Dependency -> Package Family Name: " fullword wide
    $s16 = "PackageDependencyInstaller -> Added install item for Product Id: " fullword wide
    $s17 = "PackageDependencyInstaller -> OnStatusChanged! ProductId: " fullword wide
    $s18 = "Launch App -> " fullword wide
    $s19 = "Failed to load Page" fullword wide
    $s20 = "RegisterBackgroundTask -> Checking if Toast Notification Background Task is already registered." fullword wide

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "26babd76bbb7f9c516a338b0601b4c9f" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

108c3169-8a2e-4e2d-b8ac-73f0abb876c7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion