_Virus_Hijack_Gen_Trojan_ShellObject_t8Z_aWEkp9f_3_1_Virus_Hijac_510

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@ayWIjmh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tuZ@aq9l68k_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aSgChKg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aOGzovi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_32_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_35_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.wSZ@a024O7m_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aCEmdoo_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aCEmdoo_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aCEmdoo_41_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aWELKOd_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aWELKOd_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.x8W@amYB5Bf_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.x8Z@a4IIY9p_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.x8Z@am0M3Qc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.xuZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.xyZ@aG7qmhc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.y8W@aCgauBn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.y8Z@aatP3Sm_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.y8Z@aSSruKo_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.YCZ@auWluQ_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yGZ@aSixJCi_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aCEmdoo_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aO@sVhl_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aO@sVhl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aO@sVhl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@ayMBdto_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aK0I3Zf_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aK0I3Zf_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aK0I3Zf_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aqHMScf_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aGAMRTl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aGN6KMb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aO1tmfb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aO1tmfb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aOYcrUm_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aOYcrUm_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aOYcrUm_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zuZ@a8I4DBe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zuZ@a8I4DBe_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zyZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zzZ@aCEmdoo_3_1.vir, Virus.Hijack_Gen.Variant.Barys.102182_3_1.vir, Virus.Hijack_Gen.Variant.Barys.102182_7_1.vir, Virus.Hijack_Gen.Variant.Doina.58391_4.vir, Virus.Hijack_Gen.Variant.Dridex.5_2.vir, Virus.Hijack_Gen.Variant.Lazy.21306_1.vir, Virus.Hijack_Gen.Variant.Lazy.99645_1_1.vir, Virus.Hijack_Gen.Variant.Midie.131130_1_1.vir, Virus.Hijack_Gen.Variant.Packy.4_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_13_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_4_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_8_1.vir, Virus.Hijack_Gen.Variant.Razy.104452_2_1.vir, Virus.Hijack_Gen.Variant.Razy.689651_2_1.vir, Virus.Hijack_Gen.Variant.Razy.868088_1_1.vir, Virus.Hijack_Gen.Variant.TDss.69_11_1.vir, Virus.Hijack_Gen.Variant.TDss.69_14_1.vir, Virus.Hijack_Gen.Variant.TDss.69_3_1.vir,...

rule _Virus_Hijack_Gen_Trojan_ShellObject_t8Z_aWEkp9f_3_1_Virus_Hijac_510 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@ayWIjmh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tuZ@aq9l68k_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aSgChKg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aOGzovi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_32_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_35_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.wSZ@a024O7m_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aCEmdoo_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aCEmdoo_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aCEmdoo_41_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aWELKOd_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.WyZ@aWELKOd_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.x8W@amYB5Bf_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.x8Z@a4IIY9p_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.x8Z@am0M3Qc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.XuZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.xuZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.xyZ@aG7qmhc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.y8W@aCgauBn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.y8Z@aatP3Sm_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.y8Z@aSSruKo_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.YCZ@auWluQ_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yGZ@aSixJCi_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yuZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aCEmdoo_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aO@sVhl_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aO@sVhl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@aO@sVhl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.yyZ@ayMBdto_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aK0I3Zf_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aK0I3Zf_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aK0I3Zf_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8W@aqHMScf_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aGAMRTl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aGN6KMb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aO1tmfb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aO1tmfb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aOYcrUm_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aOYcrUm_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.z8Z@aOYcrUm_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zuZ@a8I4DBe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zuZ@a8I4DBe_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zyZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.zzZ@aCEmdoo_3_1.vir, Virus.Hijack_Gen.Variant.Barys.102182_3_1.vir, Virus.Hijack_Gen.Variant.Barys.102182_7_1.vir, Virus.Hijack_Gen.Variant.Doina.58391_4.vir, Virus.Hijack_Gen.Variant.Dridex.5_2.vir, Virus.Hijack_Gen.Variant.Lazy.21306_1.vir, Virus.Hijack_Gen.Variant.Lazy.99645_1_1.vir, Virus.Hijack_Gen.Variant.Midie.131130_1_1.vir, Virus.Hijack_Gen.Variant.Packy.4_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_13_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_4_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_8_1.vir, Virus.Hijack_Gen.Variant.Razy.104452_2_1.vir, Virus.Hijack_Gen.Variant.Razy.689651_2_1.vir, Virus.Hijack_Gen.Variant.Razy.868088_1_1.vir, Virus.Hijack_Gen.Variant.TDss.69_11_1.vir, Virus.Hijack_Gen.Variant.TDss.69_14_1.vir, Virus.Hijack_Gen.Variant.TDss.69_3_1.vir,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "9ec6df33c1e0edbd0bfc004437095b101bf0549e5704d906f5555911407205d6"
    hash2       = "18320f17da28ba70178a3878d6c392808d8d5e378bcde0a54d617df2cf756f7d"
    hash3       = "26e006d2fadc3a62dc89d82fde18da956fbaa1aaae425307946045ac4f77f28f"
    hash4       = "e24ffc6abf9a4b76f741e62c5df8bad63c53db6c0544e6a4ff22daaa7aeca077"
    hash5       = "0eb814318b36710d58d670bcbacb177a3dbc964900c0e5095bf5de27341578fa"
    hash6       = "967ab78c403233116aeac7e9c424364166f3c93102f08a479939fbcdf37f5865"
    hash7       = "c0ee3146b6890481c302d43c9721a716868be7856f2841381dc7432edd68d6d4"
    hash8       = "19e08bb694bec6137f9b3647320f15a8c066879fb63c4deab6c8cf7c5c3671ce"
    hash9       = "9faa47c4e6e8d784771b1acbe4656263e1bde1eef130d83c8d667847222fa464"
    hash10      = "971545e38a2311279b5319ca6cda97806d072d13663e62d0989146b142e1abb6"
    hash11      = "734e4cbbc00682f393bc094410e64ff55568878c578fd8a0c72176e69f2323df"
    hash12      = "38a892d2b87bb6e569427696ff3f0c7764bd9d7982b72a4b78f7f7726590366f"
    hash13      = "dbfc2c6946a379df6ed7fe503b289ebfc88085dc5bb10af7f4d65aacdc2367dc"
    hash14      = "f44649ea8955c4fd0609852048a8a723d1736546d7f0ffddb7b6efbed0e4c3ac"
    hash15      = "5566d76bf12fb3d76d84d6676c448b76360592d1b19b48d0582367a1aa2cbc22"
    hash16      = "890437a9a66de8c110ebaffdb3bffaadb9c2042984921d05200ad6ba24058d19"
    hash17      = "80302a0dcc432a19c8b1974aeb6bfac99d5473e1d748a87c9b355d230c209dd7"
    hash18      = "db40e45ea27973c8e2e35b5c687e6f54137a7cb4bcb585854d610c92903ed831"
    hash19      = "e677601325cae1ffcb5b930897ad1ef8a28872e37a8e3121450e37cea005fe4d"
    hash20      = "7c4b375ca3f0a69a19da735cf934ba99607afea9fa7df0282b9e124fbcde7940"
    hash21      = "dc4b900d056ab6b3ce8de57978b5194533bf013e658a5877337e61768a177a3b"
    hash22      = "1f076ecca343c9b616708baab807c396e9576f8c56b60e2fa8c72ca6564ab3e4"
    hash23      = "864de48b3146e5d86ec52c55096856b940184316c25bc9c2e4fa39c58bcb3049"
    hash24      = "1e45b07cd22085eb5f42a1c5e387b97f1aba6025a35e9d34b1f20ebb67ffa4a1"
    hash25      = "4b776ee9c539b42b97232f4b11234b6c99da0991f7b35e423e546cfb81068a65"
    hash26      = "64df1e41a6fbf56f972edf2a05bb935e1b26211617a7eeec09b755353b6692a4"
    hash27      = "de30b60720bd23c8c2f7a0b94f19955494a0fa281c21e3dc0848580a4496011f"
    hash28      = "663b7e22c777d60bd50354855302c53d0ae99fa591d1435ef6bdbc70c6c15b6b"
    hash29      = "865624cf02cf36ef12fb2f99da8f379ad37af94a49d3f7db1c029a637c81bf9e"
    hash30      = "21b984eb8845d48684e0f47f59f1954d06d660ad947e39e0ffb2d6a89be402e1"
    hash31      = "51389dbe39faa516ac5c01ce62077a2d2a116ad6c42aecf35cbad7344f60c568"
    hash32      = "c7ac1cfade40fc54a72f619bae543027090fe7c5f97fbe87a59d6f5b99f42402"
    hash33      = "88237bbe15d3176a11673abfdcaff0cc29a9875a6a605bee94fa58df5fd72ba9"
    hash34      = "184bb356e4f8980bec464df97f64c5b305f35dba4b31fcbd49cfadf641211fa6"
    hash35      = "a373617563ff8f09d77e8808ee746dda959c78fa57dcc8e3239ee932da3d1314"
    hash36      = "9f83adb231a7c054dae06cda9fe6358abe1a2ab0100daf827fb49c57026d3991"
    hash37      = "0fcbb9b56ceb6b68d6e8a95437212859d0b5aeac24a2ef2b156d22bebc9809d8"
    hash38      = "9ac66fb8463ee1987378205137d174f9a25f53c7272241694822eb3ba19cd866"
    hash39      = "2d971e9109e4068adb02fc7c9498e49e12cfbeacf8740993522aee015492e71f"
    hash40      = "dece7aa8f562b176d342c583edbb2d51b5e87cb3a01a802df7bfb033aa4b47ec"
    hash41      = "cfafb64808093e17c1b58f4c98c469ac21b915e5b088c5f7a64c12848a2261ed"
    hash42      = "59cce623783537636709e843340f525625dfa1793836eabae85ec54071a46b55"
    hash43      = "ef9d13c694b7d562e7af8f1306992d572cb3b153138cdcfcac7409f2b1806cdb"
    hash44      = "1de87a7abdd5eb3d30c248550a3fd2dc12baa891808233807ee83651ae6d387e"
    hash45      = "da51bb01114e02889c8bd65b38472aba2ca5ba79c7182caf4112326296fa7905"
    hash46      = "653ae917d1f8113c2256b801e34eb7d8fba294e76884b7aaf7276d3c5df27104"
    hash47      = "93ee408e88b8a9b8e62136840ce25c92f75513344c4476ce7e128ab5ca4574ef"
    hash48      = "7de5475e3dec8df7f7405657d15cc76d61104b2b1b003e46f2db6a4c432c555e"
    hash49      = "518cd1cff88e192996b39e1a10bdd91af6f74c6b6b54720e23ef6353d04eb857"
    hash50      = "d732fcac747524cc6e6e85e6dd63c8b9ac8b6b95ac121cf2676f58f31786f3fd"
    hash51      = "0a554eb9d5e373457b0c568d05be089e1e41ea12d976a405e7e7c0cfa3975eef"
    hash52      = "aadbcc2007dd468cb4690987935597b01708c25da2ff79588d0f1d8a23450d50"
    hash53      = "420c8cd3bb4b94c1dbe2adc09851983910a4dbec10114a886a004c84e477fe89"
    hash54      = "91c95d2a5dab1ce52c30f046d2f40a105a50b1a32fadc7c0ff02eafc591a8fc4"
    hash55      = "ba032624a9c817db3a6c141d64a7f3d82f9187fd0eaa115a15eb9354c0839203"
    hash56      = "43d5c6421e262924a65493b5e8b1d1e5c15aec10be28411a21c15640d5e10b13"
    hash57      = "4e42ce14cc9206ee66426ab73510c35c42c807d0236a51db72fe46e5b91d500e"
    hash58      = "8ccadf4a1f0e210a5f2b89b80445f7492c46101b22bb1e6eb8fc6a4b531a7bea"
    hash59      = "1a04271e581f305530ac132ce1432c3731d30fbcc090dbe7308f92b56da0f67f"
    hash60      = "b99417d2aeb87a6c309222ac40f87b908b4d19b0fdcd3507be4478c3a436c121"
    hash61      = "6ef11939721503728a1b58893ae934961b4d2243feb18adbe556deb61b8c4061"
    hash62      = "6ee4d902201e4273562b72ce721848bba49adeecc0b7f96bf0c97b66a97e3d90"
    hash63      = "ce722e2df90237d73a80fbb076441c8fcf35300c9538f5b577ed21844ac3d63f"
    hash64      = "dbfe8f1f6193e1fbb3b0a2ff6677f5788d66caedd6fc8372808c76053375af4d"
    hash65      = "2e71e26201b26f2191c8b7c24218e2b420a397c7eb7adf46e96e9e9891872df3"
    hash66      = "e95aef6edc834bd31ae454172f324d665bd7a5b39554cb3fa6980aeb141589f3"
    hash67      = "35e101e4148f654b95ec3cabc4e1c839b62e8d6b394d447be578c5e65330de2a"
    hash68      = "273f4b0be166041dc4f143744fa05db436b8067e10a7189b8f5035aa0c7f9034"
    hash69      = "de7d4c6627c8c58ab2fbc796a6e91e811159deacfd68f4c7954b9253dc94c771"
    hash70      = "fd8a4a07c578634c148a97d15a455b6c3424c4634d8779bc4f12817ff1135a94"
    hash71      = "08e36d45beda6a0bffcbcc8b56d7756048ed258b6bf8475082d7b1bdf8fd4487"
    hash72      = "d5edb91607674cc802591a50e426f353e4a3f977042846624899203a4f03be04"
    hash73      = "d391dcabbd678383930e55aa38291b64599a7fd9376bc9575ea5b794dd828114"
    hash74      = "a8fe49a5ccb94e21e3ecb35e737bd7a3789ce86e3389e34c1ba55da25c2bd8e2"
    hash75      = "6fc987e60cb5c195f8a038d6ed17798b6f352ccec5ca6ea52493bf81861f741a"
    hash76      = "8e1fbe72554e2a9d76ca5a42baf0f00fed1734f6bf00903cf4772ac0c38b06ae"
    hash77      = "4c89b36483d624b7a7efc0278f712cc49584b8d64f826f25144e5680680e0483"
    hash78      = "407263e89f32b06565199af600f3d519ee9fd7cc7bab4187cbc044952c5d9adc"
    hash79      = "b88331aea8a1c3b38de9ea5325168eb7a28c2e0508169d7f5d4c25f118d8b370"
    hash80      = "4969fa9f4e51fdf94f7037b3cddfafa13286d06faa1bf9aff1bcb31c47324469"
    hash81      = "5f6ff10f808b8caf503145c38a74665ea6823bc464c441fa59803f88603b33f6"
    hash82      = "e01ed3ade35156726d5ab018fe455644ba20df501d0928e1a0f04542dcea39f6"
    hash83      = "8f8da17785f349d6328c1b598b740dee782075ab6cff2d5431b2381df7f68282"
    hash84      = "ebc2c3244bbe80ffa896d55b0039ce73d8b95147e7e81df43d5e35d43cbc8a92"
    hash85      = "2f04043ac441dff2c36492c2adf1d6b0bdc1ab705346c82251ff49ed75f07288"
    hash86      = "b2075a8a9e6bead6afe9bbd602d48b7675e13d7ba2feea2946c81d9a445130df"
    hash87      = "53c61e735bb937869cae20084ad6edc6ff8b16c69b9d445b930afe63c5265da6"
    hash88      = "3816f70c735f12e5c2e33155173615477d011f76d884d0efc04bdd129c8aff43"
    hash89      = "38c2f2e3c23a3cdb440f744c99968f7ee0788647ac267efd9d271f685afcf6e0"
    hash90      = "c4c9cc6844c907d60341893e2d25e9f528272e6a5ed1eef72950dc0a4aab67fa"
    hash91      = "d2d02c4c4622a9a70cecb767440d7b3869dbc914a6e9352307ec39f7401eff32"
    hash92      = "ff6b4b2c2f7a4299bcc3c569b7a2f3ee577f4909f89f1be944932633c393be0a"
    hash93      = "d15e89ea620c404041022f2d97bfd5e6f2cfc48c1c030489b73ff7b696d1a1f9"
    hash94      = "afb03fbf4362cc6ff5d873e518ec1828a9866eb45ae07b9616dd04973ba8167d"
    hash95      = "d78b24b0eb223cc35b8ce92c8f8fdcab870ebc53b139308bb7b17da27b698073"
    hash96      = "ed34b52c565a2bd1df7ed09a104bd8aaa39361e51331b9934629c2399b33bf66"
    hash97      = "1762c26c9b813fadcacff6187af0580b521661759ed9307edab2a89b1eb9f64d"
    hash98      = "c87a1d68a7cd181a6beeca3604833e9b39bd216192b6852acac4adbc9cb3b90b"
    hash99      = "63df5a555e6159ca56f83d4d76c9caabfcf667004c27c37428e3ebf3410c158e"
    hash100     = "993f528f0a8f297be973f4795ada171586c0957c0fb88d62128eba306ca3a00c"
    hash101     = "bcdaad587765dab16eebf858a0010e6809d34a61e5ff248663f28b1693b96a64"
    hash102     = "222e085114179111f2e7c7d9133edd0554c42f37a742f6501c82c6e5163bb4ba"
    hash103     = "52ea0ea4a1a112a06dc302a01101492230c9f7b82457d55c256e5b4fd936c351"
    hash104     = "231d9013d47edcf3d22f617e58937ee24b0b12488ae37e6b0596abb4caf7ce74"
    hash105     = "b52fd3c5e42ae8e1f38c894362ce3b5aa7dc52ee2d0984f8a85d98ec6314a714"
    hash106     = "34dca610db49e0b65b0168f3e6979fc4bdc5e6780131d9a96d1b807bdf5d1b66"
    hash107     = "77a816d60db4a50c3f15111c5d4bbd116c55f53f83cabcb993807fe84b69fba0"
    hash108     = "0fd1a7e7c1ac649bea17a476944778e27db1bf35ae53daae921a2d449a50e95c"
    hash109     = "cf898fb4598b0a13997c2580df5df0333dae2b8f2e0d8cbe64dcd5cefe891d0c"
    hash110     = "112eff77c8acfef1278fdedd49849bcc2819a74bb070db2abc196885f2e1ca85"
    hash111     = "8c6f076e9d275bcc740406a107a2398c2b16965eef903fc5b17f3ef466ad29f3"
    hash112     = "e907bd56b85554a18b60d21e27b8dace7a79f67a667f3f28166ab1676afeb893"
    hash113     = "c4f7201ed41e92ccc41037b02004cd178fdd1b0a88af1921d9b5384397621330"
    hash114     = "fabdd0a0a3bc987ce8116160b19930dd7f2516f6a75e47edbdc6f8bba1f4018b"
    hash115     = "8d9d0b03d8d73498697df0865874ae966e8d5c26c6528e021f793e86be0e9468"
    hash116     = "78f7f526bed2737d302d75390bacc29e65ea7eacf89f5ce767d566ce28d56969"
    hash117     = "b3bf3ed5f33b49cecdaef0fcd7453150449ea30e249372cc67ea8d4cf92f158f"
    hash118     = "9443b1d2e0e8985a8611c84422c24bd895eb2d6fd31237e894d4294b690b4619"
    hash119     = "f70ecaad1f6af649ca82528773afed1bdf671f5a1e1b3cc0f64bafbc97105d13"
    hash120     = "baa03dbda760bd6636e68665aa83fd272618d497f6afc817ddaf99d643d3ca7a"
    hash121     = "34f046e20d2d76f9b273466207c86df35a053c93d65d363b445e73174aa644ea"
    hash122     = "35d551296da2785adde87f4d10df8c8b0a69ea4a352261a7bedd085824027881"
    hash123     = "e9e44c540fcc2a2fb1a20c783a3b176b85f37ccbfb4aa2b9aaa44e038b0eda54"
    hash124     = "2ed6cc42d1ad39a811bc2d5b8c97f072a431dc2b38b7a8df336643f463b4b8b2"
    hash125     = "ea13a71fc1d63664839198a9382061d9ac1ce7486378778f392aaf77b9243f98"
    hash126     = "4965e14579d1d8473a1ff9c08fe5c59d242c87437dcf0d0bfd069ad8f803d5a9"
    hash127     = "38ebd2786750fa16482b4083382626f6eab58c4dc34e741b6bec5099d195c729"
    hash128     = "7e456753578228f59ac9ff794c899ab9271e2348383fd2286171259e91477733"
    hash129     = "1819ebe375188a1f7c054e5a95a7ebfb8c0b4c9b3a5099f859794a9904aa48c2"
    hash130     = "8cabf4224bcf14701c36116443a4c025fafa45f20edd6a5d32f9b7c8f05cda6f"
    hash131     = "2ca751ab0c6caac69047feb8f462a26f6029b332a3b00e6c2a374750f76ba3dd"
    hash132     = "188083b503e236e76ca5a9f4a3b951a7447c93ac81bb94af8af04c2c0d2ae4ed"
    hash133     = "2182da03c3e5a30b52904e1baf7651fc04c16b8ce1469bbbe8f44021fb93aecc"
    hash134     = "2c90cd9c711632fd0b436e5d6aab95e0861db1c2ea923b96233d22e32cca3525"
    hash135     = "1ac67b70ce912076ad8180870598032985f67ad9d4243b97b115939c4c006336"
    hash136     = "e005abd8492871bb98e32601e80e13451afd9dea4bc13867225f66f6b3a72ca9"
    hash137     = "b16be24ebf272853192aa0ee83220dc39d7fae3e8880c95e4bfea9c1d6004b38"
    hash138     = "64f89265662e4aea26c3e3b5426a475f0547e786fc4e677e11f8cd9f5a517ae7"
    hash139     = "7c1bea935a89ef45ba5c19a2a6111efaa5321ed7157bbaef578635ce6f72f83b"
    hash140     = "aaa610d5a23bbf5162d28e9d8f855fe0e05cb2d955d53dffba9ea6a92d91830f"
    hash141     = "cc07c6cfca669768e25abccf795cfdd72ef9bbb19857b3403e6c3bc565e71abe"
    hash142     = "59c3eb7045cabc440b0809e3218bdce4189d60d60831cd723663c5aed1e801d7"
    hash143     = "54f7b0e4fd9be1a21719b642c512454ac18702d4d83da8df8033995462a10323"
    hash144     = "41f605bfbfd2db68268dc674ef9e119f3510f667d48ec66e7b835620a4a1b49f"
    hash145     = "67701ac7608c2028cdaf7e585d3348866c8dc55edc8701008c1dc6fe1ec3e99b"
    hash146     = "60d658882beed77fa2aa3d53d6e29bfcefa953ecb161e0380cad003b1a29edf7"
    hash147     = "e3d2249ebb53739e1604b8a4c4871d03ab3066a27d21d70438fea4fcf8edf9c9"
    hash148     = "ff19c75a0919ca384569132f5b569740fee1cfa6709fbcf3d6d7dffce4c9b4ff"
    hash149     = "94e5371a37f6f91368fea9f11b7851ffc37bc3e521f0ca8addd436f207a8fc1f"
    hash150     = "980a5698d30468743c3c2ee2cc6a2fde61b64b245fc28c2d05f7d2f714e4010c"
    hash151     = "677296683d2b8dceaad77e8892b18c537b99ed69293541b84b6a78505081ac5d"
    hash152     = "67e987cf5ef8044859a6ab966f6c39354858fd97a88391d85b0ef91b03fbaa7e"
    hash153     = "92056d3b392ec18b8123698d5fe159a149cc700cd9bdf3d792fb958d207f35ad"
    hash154     = "a737e17fb530a75e7cf9f563d21ab6295d67cd87f928e557d1bfe89f5b73cae5"
    hash155     = "8b8f5016006a227fec8fae75be4a5d47d1a32f946f99096ac974f666c18be0af"
    hash156     = "e9eeed7b606f138a58696a6e906ebc0ba4f8365da3fa6de9f41187d370d4f3b5"
    hash157     = "153c5c976747fd7da8d23e053cc907be4c50fef108b59a4182af96acf3a4934c"
    hash158     = "edebf3297fdb0bf958a5bd93e21c67cd53fe1c457c23003c24093b3e855c23b8"
    hash159     = "a8aaec94b0ee9f5ea1d06c4530941a5fc0deeeefb29f5076fa7b7cd21757cf7d"
    hash160     = "16e0409b0b72fc4049a06105544efb28622bcf012101a43efda3ec847e5016b9"
    hash161     = "ebacd1dc2080fdcb08455c7cdf36e53f0c13e5207ebee40e80be65c7c79b5857"
    hash162     = "5b3d70cd7138b2de435c38cfb259c269048485bc82588fe34d75638a5e097c2a"
    hash163     = "0c8df616e08ed8b8a45a17d1faf8db0c9032ded40080e29b67481b5570b28d49"
    hash164     = "632089462e7619f940eefdf165bf6a64dc1c2cdbe555ee0f481d416ec14f16ae"
    hash165     = "4b54343ec43d0beb74e8ff6dce6ea3d54110fb9c2d4ad28b7d06d27a80de344b"
    hash166     = "dbaa5f41f187440f2b5cf20c66ec82fd8e85d088e8f418a7dbaebfffa4db222b"
    hash167     = "8c41229efd93457ba717be9f661a3986bab2a220e4c993ebf9b1bb3068763a5b"
    hash168     = "9ebad4ca58ef722d4e843e2f8c3d36b9b0f1286846d116255e8d07c23d0560b0"
    hash169     = "8e0281215a3e43c334e3a9204a8096d4db810fecaec882d5ff18305a64ab2b3c"
    hash170     = "15f8c2cfc012ac1419f5b34d7cb2a05dfa286ebdc29884a2d374dfb4b666e8b8"
    hash171     = "c4cf13de8f9bb2fd5bea46117d3c95333e19dee9aaaedeb129807bc1cc7f7159"
    hash172     = "5799fdfff337cc96ae80127223678bf8c3c086d4cd8e1820c05825d0478148f4"
    hash173     = "3cc0f7614afd25cfd2e3dcde9762d2fb0e83100536d99a425afc9e298c6253be"
    hash174     = "cba5b52b6a9725cf478c42ba78da694f5fd1c42f2c0eddab6dbf46fbfdb33477"
    hash175     = "f5b40033b1e588913b0f02fe99203e3a77b30040c52f96dc96e06002fdef9431"
    hash176     = "7b5793f2604c2720aa1513750ece0d6009a6fe39a3da444c16c4c84abbba9dbd"
    hash177     = "f2c72a3eef2dceeade56cc0f92302cf1a6a7de1a60e70cf8e11e0064bcfc4807"
    hash178     = "895747e9dca6b965648b4ad2c65c643f0e77db41a5164b0620b2b8315b71ac9a"
    hash179     = "87666e91953aa133f50035eee22d9729c387b30e897e09fa69b6b50fa1e56408"
    hash180     = "9cc0f97d9b73dfc579361b8ffc383b31c8d31107f0cd75e7e476a37e02edfc39"
    hash181     = "58e410b7f5c9ea2fb273069a5f33905dda94f2b8c2f9213ad0f7e1a8ac273d9e"
    hash182     = "b3bc138711943b4ae73fcc043089769656b9c77d0940e73beb8ae8a43a49fb99"
    hash183     = "48f3a735816099c00c0dd4e97b06c2f71afe9b6386ce70f5213e722b88d0da5b"
    hash184     = "1d814a9a2142d5a5501f74196c2384da462fb41d57cd0bb45027de76207968c0"
    hash185     = "8a28e2c71e10aad408112fdafd119cba8dba7418bf532616ad61b873a9d6da66"
    hash186     = "9b50e9f15ec982756013d9f86cbcfcc94c839f0d9ac06da4ae832c3b39df9a53"
    hash187     = "f313e832ef7076a2a637299de470eb1737fa62f9a7f08c26277dd022284dee8b"
    hash188     = "de1be583715cb10cb3b552a8297b7424e2363902675a3baab274b129acba8331"
    hash189     = "34f249716c5fd710ad8263a21365b4c77d497755b964864fe6eb6cbf1d91e6e4"
    hash190     = "82d177d5d98cd5ecea320649c3ee48aa4a13d9cf129573e5e8aea1b356c49e3f"
    hash191     = "c4aba4ab71525bcfef275147b8f934fbccaf94296980ca4e8105ef25b0f581de"
    hash192     = "bc8dd91206241c936ad835e1b8eff3c40602e4c11ffec46f9deb6e8247f9c916"
    hash193     = "ea8e203538cc50751bd86885894c7b2e9175b30ddc77816551da75e78f838597"
    hash194     = "5f15461006c641c3b6ae5bc67e1082c230c8e8dd69ca01a5d57a83e4c2296f26"
    hash195     = "7881359b092443a5ebfb782409381c12bee2ae3413f58a15600155964e16129c"
    hash196     = "1ef56bf9ffa4fded22595a6ad4ccf00e8bd5031e8e377a9389d7ef94f2dd1fd4"
    hash197     = "92494867a4bcc829ec57a45d4586da281fd0a90a94ab7d85cb7aa7c25661616e"
    hash198     = "a14dc5b5a03688a7ea3b34329e842f79ba00a6a6f0f866c9a000bb829617c3ca"
    hash199     = "a6efc079c3819ae923c4351e210b0edbb2c739776a43980582468661819c7292"
    hash200     = "335e69edaa06c108545fd2eef82720f48a9fdfa40a42acd8f2e52f5f0f4d7b16"
    hash201     = "1462e1b136606f78e2ed980bde2940b4cffdba483b8a24583d23a4005fa75bc6"
    hash202     = "9ee21aa0eda1155a287e121fa6fbe8fc350c927f59f571aee0d124f37c36eabc"
    hash203     = "f863e85d11e30b4ae4f64febfcbbed3d80baa7050519862b9ac1e7921c0a4f41"
    hash204     = "edd483a31e4205332d68d164c0faa2b1e4425fd2bf7414ff06726f0102621b1a"
    hash205     = "3e97b9a15462a6f98835196aba9f06506f4cf6b935f0a522c7b6da32e8d4915a"
    hash206     = "46b536030d608d3eadd49e8545c795deb04ef659196a59a78fbcb4aa2f0ccac5"
    hash207     = "a961c6aef8f61a1d0e0e44dc2d046596e56a79021b5844e0e61fe765a56b9c1b"
    hash208     = "3eae1cda2c94be73fe9a2ac81ad7e1e4c04cf62ca6add337ebcf5da2ee4dda96"
    hash209     = "f6e1032907e43bc0ae8e0a3254f2a920034b6d5679c7516c21930e0177d6b3dd"
    hash210     = "ada3520f6ba98e7e9db0c93ddb3ee0e439e755830d2e91edab8c4d57663898c7"
    hash211     = "d53db79c0549da085adc736dc64ef974889b2a29f83cfcc36eaf622d01ddb41d"
    hash212     = "faaf407f486b4d81beaa301c0bb4f1f22a661a047d3293d5f7426f2f629ba4aa"
    hash213     = "7d11d5f91f9f0d170b46aa1e67cd71a18db33aeaa868edf9d1602ce147f18cb5"
    hash214     = "2eb6696465e07e89505185be5f914fd7ea8382002ec4389fef8c3d6a85927cf2"
    hash215     = "dcc2d69dc106f82474cf453f733833b3e7a77e2fd6743eb1c8feee5aea381f93"
    hash216     = "31443154ffebcbb145717fc870e58486285b67bffa12890a4441b2cf007ecf31"
    hash217     = "ded1eb18bb21dd0d05ace91b92455a4d1aa4942ab671e7b46f658fc32f38994a"
    hash218     = "23153e2dc423fd2c1723730e8724e4efa40e83775e47f70626d7485986644938"
    hash219     = "0709534705eca290b128e9971b62f4f7da8d214d3e94276175ead0deb9011613"
    hash220     = "7f13c58e331ea8fd4c02c67e62cc0fcf73bf79792450713615e92b5ae521da88"
    hash221     = "3510a55bb51fd545240416e7feb1e10fa6929cdaf91d52ff7a97c7725db819a5"
    hash222     = "788e1ba2289295d1eddc44c1e64da567126861bc6a2cf41ae8cca713ed1784a2"
    hash223     = "8f5faf7b665cad445b58c1eed6ae29d892f25a5a015fff8401e9b11738862957"

  strings:
    $s1 = "t:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-12-02T15:50:06+08:00\" stEvt:softwareAgent=\"Ado" ascii
    $s2 = "when=\"2018-12-02T16:02:59+08:00\" stEvt:softwareAgent=\"Adobe Photoshop CC 2018 (Windows)\" stEvt:changed=\"/\"/> <rdf:li stEvt" ascii
    $s3 = "t:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-12-02T15:50:06+08:00\" stEvt:softwareAgent=\"Ado" ascii
    $s4 = "n=\"saved\" stEvt:instanceID=\"xmp.iid:d9d77401-7124-ed42-8b71-4014b651f934\" stEvt:when" fullword ascii
    $s5 = "\"Adobe Photoshop CC 2018 (Windows)\" stEvt:changed=\"/\"/> <rdf:li stEvt:action=\"converted\" stEvt:parameters=\"from image/png" ascii
    $s6 = "6-2.1\" xmpMM:InstanceID=\"xmp.iid:d5974899-ca88-7f42-9516-8e7635808df3\" xmpMM:DocumentID=\"adobe:docid:photoshop:953273c3-3fa6" ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

cecb51f5-67da-437a-a0d6-6c271e3281fd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion