_Virus_Hijack_Gen_Trojan_ShellObject_t8Z_aWEkp9f_1_1_Virus_Hijac_527

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWlu0Qk_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@ayWIjmh_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.tuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tuZ@aq9l68k_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aag1Gcl_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aOGzovi_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aOGzovi_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_31_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_34_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_37_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@a0fL!hf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@a0a9m9p_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aO1tmfb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aqDKVYh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aqDKVYh_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@au0WBJh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@au@Zokg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@au@Zokg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.VAZ@aCEmdoo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.VuZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.VuZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@ayMBdto_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vzZ@aSgChKg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.VzZ@ayMBdto_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@a4IIY9p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@a4IIY9p_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@a4IIY9p_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_14_1.vir,...

rule _Virus_Hijack_Gen_Trojan_ShellObject_t8Z_aWEkp9f_1_1_Virus_Hijac_527 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWEkp9f_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWlu0Qk_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@ayWIjmh_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.TBZ@aCEmdoo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.tuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tuZ@aq9l68k_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aag1Gcl_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u4Z@ay8bj9g_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Y@aivto4c_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aCZnhbe_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aOGzovi_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aOGzovi_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqOJzSd_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uCZ@amHJK4p_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_31_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_34_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_37_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@amBwvTb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uyZ@aWevApi_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.UzZ@aCEmdoo_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@a0fL!hf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v4Z@aqH1LVc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@a0a9m9p_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aeVeeJk_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aO1tmfb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aqDKVYh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@aqDKVYh_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@au0WBJh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@au@Zokg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.v8Z@au@Zokg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.VAZ@aCEmdoo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.VuZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.VuZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@aSgChKg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vyZ@ayMBdto_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.vzZ@aSgChKg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.VzZ@ayMBdto_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@a4IIY9p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@a4IIY9p_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@a4IIY9p_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aibAbeg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aqA82Sk_14_1.vir,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cd52224df1b96a1908d32bb10390a55714f321f159c0739690823b42d837fd4d"
    hash2       = "06fc0f0b751b948c8c7621fed2c73f27dbbb6a81d87afd4b059d85a9fc3fa390"
    hash3       = "547cfd32a47931da0846a360cd64a4db4612b1966011536143810e6072bcb4bf"
    hash4       = "fd41077e92344b67e3c4e959a18fe773a21981b12fa029d4c8aa0e7d3e94b839"
    hash5       = "494a39f8e2a33d643c1e7cb8a1bc2bd65af0db01ac650bff0efca34106ba7864"
    hash6       = "da3f931cd856a47ad400b460f96ffc909e8730899cc41afe0adcc7c6709e8c7e"
    hash7       = "b277d6d7ca93227171b3bd9dc8bb97486cc6183d0fe46453c547fb5eeafa3f91"
    hash8       = "d156667a59e5bcb1293f83d8cf33062c0b24637587a8c444ad3f4ae367e8f2e3"
    hash9       = "b13ea8e314436094a48cc84e7002ba85b1897656b2a4ec339f21ff5ee6f44ee7"
    hash10      = "a02986ee07cb5b7ff78800919bbb48fa2f055d7435167370aa1578dd76a6cf8e"
    hash11      = "4d937d122e5722bc31cd7592ddb1fcdfd736dbf9b1a7dc8e643522d87a5ec88a"
    hash12      = "0eed04d03c70b3447d3f5a9781722144e6188435720efec356d68cb69533384a"
    hash13      = "99af40e93f9de036d0922ddfd6d847383ae004ee95155cc211519643ac666816"
    hash14      = "70c839ea04091d0a9ff1de980142c993a0ffec83c6fefede8e789b93229d9dd4"
    hash15      = "b988ad47ebbdc354b0a701f049ecde7190e2043923dac4d3b4df7eefd4ff59ab"
    hash16      = "3b03c6459042dcb4a5ed70307221b13e324c51355e9cea9416d50e21dd49c272"
    hash17      = "8e851e58212c0fe8ff2a75f626a8894d3ec2f6ecf291a3edc01d9fce08eb46eb"
    hash18      = "2e1896e5f3648a3e16f28db0fb901d7648998fe6504be0f56e30cda8586c7928"
    hash19      = "1fb036616df2baf571a4509fec747fbe98551842b41d85c6664eb966864c9111"
    hash20      = "dfbe15590df3245889be364d07f4b8cc6554be708e6d5198488f39a5ba104a1f"
    hash21      = "c0c15600cdf691f00856bfde99688948eab09683a7efe77b338bc863f31516b7"
    hash22      = "9618121e429fdf0c2413f5bffbb8d38621d40f0b10d574e985f5eb6fc2c41932"
    hash23      = "32e1b6f67d972d3f1f2c33225de9e963ba8b7097eb7d117ebce4a94c2c044414"
    hash24      = "2e3137482e722cce7ed48953ccb06155941001886bb33114df57c8ae361cf703"
    hash25      = "00d10862eac3f68e0e48c75624f55efc88ac6034355996017a973f728e90208c"
    hash26      = "d2b0b2a2a868e3ee7fabd4f4bce33c7d6bd99f9cc51181ddaf9ff7235f183f1e"
    hash27      = "1fa9704884cd518d97ffb5c61836140cdc400dcef7dcf01be0d447d59946c797"
    hash28      = "fed0693bba62de2f36234f72463ae5626855930e4c0a8e49d52061cb404227b8"
    hash29      = "09e4f12218687167b3bd1a73d0c552554226500b852de21971dc592a87e0aff6"
    hash30      = "3048732621c9b4349315023fd75582a765691945f1c78ac5f3bd34de714e479b"
    hash31      = "480e3b23a2343bb5b324b7248648da17d6d8b4f8668dc2f0cffecde4bdf6067b"
    hash32      = "b1d65720a709413dea8c0a0e76197bf429b83f11e21bd3479a7186db0d7f3dbc"
    hash33      = "661c7cba2bafeaff84ed96c5dc707a722fe9abe26913563613b67fed097a2c60"
    hash34      = "80325ce21163b008f63c54eb899793ffab208e5368af476fc8befa6e95f84f49"
    hash35      = "242678ffb91b41722178a47c90c1c4191da6e7f75ca1895b49da19a643cea4fd"
    hash36      = "1f2abd5e87f62f63ea93db3b2deecd2749bdc03b07c1b1e9bdd5d52162453bd2"
    hash37      = "d959d47281b114130d405fbacaf758824ec8fef59a37c5e49012f62475fbcc8a"
    hash38      = "7ce16065017432702c1a8f0138c9627d4ffaa90261b277e1ff405eba7db64334"
    hash39      = "0d0a959b4e12411f0ded26030d2532c93443ae50f8d8b83fee0c3d776d5a71b9"
    hash40      = "dac628c813caf703ce584a41abcf7eed1670189c3f030ba5ce6d8a86f75a3af5"
    hash41      = "ceb36a4469e5017a25635a2d241722a3abb0a9e5fbbb97673668f3e5a4a38d90"
    hash42      = "f2c81f7da0d28e45259c26d73df27d035c4c7933b3bc3978657e782d731aefa4"
    hash43      = "fc5c6613806d779a06337b433db76b4117da5e5b8d3036bf58a3d33643460a3c"
    hash44      = "67ce72f57eb5674dec9e2e7f54534830611c0fe3bad96a1d377557634d59cc91"
    hash45      = "7678e84dfee045a8227a7d062c478fd484e2e6fbd1d3e33c7947dbc6d732541e"
    hash46      = "26bc5cec4cd4d6d49fa1bd61848abe14f3694ee850080e3fbcdc08b1fd6b55c4"
    hash47      = "282c88b5a710ec6390bffbfb92852ea267cf9c88ec399ad440845b8f1087f803"
    hash48      = "0c1c894535c2b7a6b9c87338382bbd6a17328049b527528e84a922d024a2e014"
    hash49      = "dac9e68b90a5e53095c104d4484235b265f97e4e705bceab661afab246697c07"
    hash50      = "a88fd07218b24b09b785637af96f8a539827d552c08bbcc8cf7a9b3d71c2570c"
    hash51      = "b555e47497ce2b5c30415f2b294b1cdc2caede64f57cdcd48479b507fea4d649"
    hash52      = "0ee927abac84f4dfb64c09795c865780aa4701edf4d5c4a25bd4e79e121bf675"
    hash53      = "3ab66071d0902d5e7840b468e9682b364390f134a4c75f3816e3dad19135dc46"
    hash54      = "50a97bec8129b1921a635c41f935a36ede23da761fe8ec4bd2bafd382e742d94"
    hash55      = "44398a4d403b284b86ef0af6dc48016c857767afceecbbe333177ac69e9187b3"
    hash56      = "336c8d0517ab7e60ec8c320bda85a6f78783c9dd2f6fc1859291a62cb04359c7"
    hash57      = "815f361862873b3196f826b99755f991b9e7c1b082e6a012a7deb3119265e683"
    hash58      = "c486b5055fe87d7a478fb6621aca70f8f1f750e18a473256aac413708960c281"
    hash59      = "57371ac25887128f495aec1c00d96d067bfef6340cf93bd36a7b85c623f6bf2e"
    hash60      = "5c27f01906b149d5b0a166154be6ce19a1abaa27d8431a1320c1a0732bb5ad30"
    hash61      = "8f1e6627a5f3046b9427ac0952475516d66f7d01d751815d7aea854e0e945211"
    hash62      = "53a88336f2f63a0c8f3bb37b583bb2343bdb2cad97e655073c1f84ca6de268c4"
    hash63      = "650781f71c58aad2f22e7bf565c11adb0278ce9ac956ee6c7c95017217baa284"
    hash64      = "2ac27af2fd221339bbe9f02fc056a9079a817b910b1741af0f511734f9961985"
    hash65      = "33d4a27fa8308e93cf64957855e2b4a892434b1f283cbe62e3a9947400358c42"
    hash66      = "af94931ec5d032874308bb41e5e5700936655cf862af1c9ddef1f4746f1097f1"
    hash67      = "21f08d3663d055af62ee0bba1302b1c2ff130adeea41ba77d830a6e618a2a222"
    hash68      = "39235a897344159ccf4821e71055f3b9981e53e6e3b8d196a56538a6b931376a"
    hash69      = "afe4961d469e9cb485aabf849dc0f99cc7a1f230c7cc7de8f34ac514d371083a"
    hash70      = "a8129ef7cded0c03126a6f5179f6d55db068a02bc132cba64079eae368b49aaa"
    hash71      = "76399d9a238f0df7076005a8589c26a295101f35a3f59141e3d813f2bc2fc0f2"
    hash72      = "95fd1c75156f7f07642ab8392bd958125168eeeeb7aaef7f663046b44c21bf19"
    hash73      = "1eda5529dd0b71a6e65a68818ca2899d707f09c0b27acc9cbb22b0d635f709dd"
    hash74      = "8314e8ef4edbe259d3d529476d088a42e2548f5f89321a962d50d3dcddd7c5b1"
    hash75      = "c7ef80db96c177df77856ec7333774eae4297c54024507a40ebae1d620fb9da5"
    hash76      = "f606fced232edfcefdd487f043b907ea8af69faa3c3a8830bc44b0120ab7c5fa"
    hash77      = "01812ff4f8601676b69c863c9ae0bdfcd662e8b7492eaff5e1787e53721e3a13"
    hash78      = "5259f9c591111e39513bae145d63488f1033383a26c94a277575e1dd6262ccaa"
    hash79      = "eb1488414b29538d4ceb6cc003c0904c8d5890b055c48263ae4033a176cd62a5"
    hash80      = "1cdd8c2cdb368666fb306d35c79a6af6dae801f82e96e8efffcbe34bf54edf7f"
    hash81      = "0c23fc228903cb2a807678c4971269de839365ef21c4f71a64a0d8936ac4ebd2"
    hash82      = "2532a03a930b05f2db3f5e23dcf29607000af93b3f34181e17e2749588cfdcba"
    hash83      = "65288055502f25dfe07f548f6c8434060afdd58e1f6b2c554c826353e00be65c"
    hash84      = "cb6059d7833eedfcbe05c7badab312193be921ea7e313c01b948aa18790ff98c"
    hash85      = "939c8e4e96fc43c92160c9ffbc82849638ed6a66d68357520a6f55215ad1a0c3"
    hash86      = "d55f771ec698e875c01e6c971b3d4a1eb87344086b8f3d78ea509dc6f87d4272"
    hash87      = "0f4e1282e988c8442faab1e32a5fd72947d73360f365e5e8f42021e16810da2c"
    hash88      = "dcd4d54086ccb439959748bee5e81bdff0c54c5b285a1b0af1526ca2fb90d150"
    hash89      = "bb12224c5854df2c656963aa13b2b8f28f5eb3fca28073190e796c25c7e55259"
    hash90      = "37086e0027ed5db3f9bc2f76c9c73a2c4ab3f534f67438682a63a6e3c153625a"
    hash91      = "54aef8124e39703bce5e125d241e67554b0c6ca0952be50dbd2d09e6af6df50f"
    hash92      = "64c915e48e397c0bf4ccc3e34c063dc77484ff598bf4bdbc76ba8c2a079aaa2a"
    hash93      = "8891cc0f7cc6a8ea10b7122745ebde21e797951e8cec7a7e5a84319338ebcca2"
    hash94      = "8e323f9c10ddf8a385cf0f1f0d806db8eb89af6b48855a0c1c586a53a2cfbde3"
    hash95      = "deed8aacc3772b584f086bf1cf55363975c08e2004f1f9b9db7b522c162978f3"
    hash96      = "688f8ace8456a9f1ff3af54645fa14deebd10f1da5c54d5db6e1938c5a57742c"
    hash97      = "68d8a1d277534fd919a257fe630bb84a29d5f355f5b33a3803ac0c53cf820585"
    hash98      = "a151823dcc5205b7b370846245bc6eb95e810c090ff1a10bbdd43ae65e3c52c7"
    hash99      = "df5f193a6b362f8d80e2929b362eb61f5f286fc5a9ae2e214ca096b1f23293d3"
    hash100     = "51b224f0b6155061cc981c3c56776250004b7317aae0266f44cbf38330d6f67c"
    hash101     = "cfa2d7dbca3dfc1938d08a52feb6134b2bdc054492126d6349dbaa214c494231"
    hash102     = "eb44f2768c6ba34290c1addf7b37f04c83876a6bb160403e33e9e7c08d83e438"
    hash103     = "bfc71d591380fe78811f3df3ec3a2d18dcaf82e2d3693741d211d190ec15671d"
    hash104     = "33e68dc4b146d1a825b1540c4e4cd6ffb6001bd59d992e54ef75b4d58bbddaef"
    hash105     = "69f2e7cb90743634d0197547e8a94d0afb33e3f978ddb884303273d1e7a859fb"
    hash106     = "942ab3ffad4d39e9057907f0a7c52d926816e3a2aea4c20e941bebf416459517"
    hash107     = "8a0968fb83377c838c7eaff77127800df7e86fca1d11a0f1ef6b9b8ec8c5b660"
    hash108     = "5b757299046f2f0b4a06dd8d650c760d4a304958ff043e0863f706be5be52495"
    hash109     = "1e54f052d44b1d0281226d9a4d3c96103c04748a86997d7372c59d06df44e2fb"
    hash110     = "2b41e12eb5fd06a2b597149a2d10402574773d72378c1a57979490eaff6797ec"
    hash111     = "38f31b76275d18a683f05699fdc143ba8944b40cf5b21d936429f7e29f0197b8"
    hash112     = "91e83604aee2a3859a5efb09d81fabd2c743817afc47d7885b2b6533e56647a9"
    hash113     = "9b9afad4c6747375178afc84332bd173d114172086e34cbd7a56e3e2824fe1b1"
    hash114     = "2c2937d6c312b0a0aa4555905a3309f57ce3375b608ab3b73ce18e378c99db6c"
    hash115     = "a38affc23b6b02ed1a258b124b319aa761a3dbbbdf70ced7b0b52641c9f97814"
    hash116     = "75934e36f0d7f02fff4a2be5d8a9368e805bf8174816b975830acdc3fffe9803"
    hash117     = "5c02b1b08f6408af54535be4e3c5de66b61f9dd88cd1cd814c8d55bbb0146375"
    hash118     = "b804fb05164017b86aec9491d44a99fc584f0bc0b88814e44199b213d226c468"
    hash119     = "087a4128ff266ef5aa999945150f4f595d3e25816c51014feb7d5a26449d9529"
    hash120     = "3e53bafba89b1e87095cddaf94f1ac5a2c335fc16acc459039799234504c569e"
    hash121     = "fe4c645eb9a0ac2d03fe6f3ba78414ea40e4c78760b99504bd31ac81218d77a9"
    hash122     = "8e647c34c881f236772dcc4604f93370e1cad8c84be7ff48a1e6e81e6995af88"
    hash123     = "69e7a36f964d94f9760fd9aaf4d8fb54585ccdfb2f9615c15b0c7a20e4d538dc"
    hash124     = "4bd3c0d0c5408455b163dfc5ae8e0376aa59b09a9b62e4b07dbf4184058076bc"
    hash125     = "931dcad872ae31228b134671cf740ded14848041873b9c086c7de2567c3d7ffa"
    hash126     = "c714089e2bfc89b648b8ea0762f3d081711ee38ea991bd66844c9cab39994cfb"
    hash127     = "dbbefb7292a587485b837d2df2acf43bfb6a349eead2e80c5ccfb64f77910b78"
    hash128     = "afd87429f2d1bd58eb09282f29f3f411de520ae0818c66eadd01aeeaa95f63de"
    hash129     = "97dba8956282806632368630d89514d4dc37a646a354a3763a29663f3bddf522"
    hash130     = "7b38912553bd715092dfaa5fd4d9788694de93fbcbf74880c3ba884d86be43fa"
    hash131     = "8f7a865af0a708399be52f5a6ef05e3d0768f6bd4ddef97bc68524da658c5389"
    hash132     = "15aef29174d888bd08e08dac86a059617d648c04893eff770cb1b621c131244b"
    hash133     = "eec172affc58a41ddbc4fdedc5b4d9740dc4cf1c7784c80965b30876cca41756"
    hash134     = "b9b98b1822e3f19273c47bfa767f719898f91ba84f8d7bc187bb01532515dfc1"
    hash135     = "fa278fa8b7d0a76bf358287f4cd72c5ec5e5d54751da839f3e19b80a5bd8a2ab"
    hash136     = "be9b9dbe1c85194d1a4285c446bed4d4f6e89999f908d436312d63aa69a655f2"
    hash137     = "664d1e83fa309bc5038097b37b2015784d246ad83a83f42b2dae300043d93a09"
    hash138     = "d5f937c86c39bbfbbbf8c87f15cb4660f53b0570eb9eb854fed3d21178e32e72"
    hash139     = "56d636fcfac50d3a53a89b448c2d31dbc5b895cd6834b3dd14f44f1411831a2a"
    hash140     = "29509af0275b8554f099cd3d4a4a77a0f54cf3cb590ea7d4910b919061d42d15"
    hash141     = "84fca984048420886e211e6238e8447cd6c079c284343f569f464de84391ed55"
    hash142     = "93caefd3a865fbd1e8816b3a92aa3c613b1223e41f9d97332d44217593aed6ba"
    hash143     = "f29101b1053814ac1a72011d603a74843b5ac6a13a7c4835fc17176318889b43"
    hash144     = "a405803bca14cb59cc56c0860b7ecad8cec814e2f9eda01d9f41483dc82086bf"
    hash145     = "df3fce6ffea31aaf070432fb30952ff4b9689d92ec4be320fa407d1d3d529825"
    hash146     = "da12e48bfe715a3722a0f45a9483ddfd474e8e1ca03ea33be4ef803facc59cc4"
    hash147     = "b48e49f4f4b287e4df07667f9b782dfe11b0c7650912c6fe6ca99d9198e53b92"
    hash148     = "59765742c4fe4109c8e9265220096e966fc60af7b17424b9e7a1eb0508f935d5"
    hash149     = "80df4783abfdf25d0a97aea907a570431e458c82dd2e8323931754af8d5f6c7b"
    hash150     = "690b9f60d030fd1c5864cbf7dc0d2acc9a22e859bd95859b94c0e853b6a8ed73"
    hash151     = "1364db7064b3baea843a2872feef962f2b484d4fb3f3ef27c3f9fd3ce6e16bd2"
    hash152     = "d38f54bd1b44334678e5cae4a3e28da781d15511d9ba461fac6966053e78ba4e"
    hash153     = "f0fce7ce83ebb92e4a77a89cbe71b3a6869b5e76ab12f120197018434711d385"
    hash154     = "c029ad6b4bb9174105739fda07a06d9cbf83d05d614d61056cd96a2ef747fb24"
    hash155     = "1228d2a6b12f5a6f185bca3d1c16336075fe07c873e898eb93f881f7a2326783"
    hash156     = "7e452e8bb642ad09e7d7ea50bfe6d42d1537f565633ae0b1a91f5da7514948e5"
    hash157     = "cdae6a3f95ff4759ce81612764aac0980866a62188a3ed710bfefe899cd2b40c"
    hash158     = "3c54f3fcc8f1dc543cb148ddcb7d3c15c61542a682adb4348c3f5aa8edea2d47"
    hash159     = "9b7d250046ebb385fdbb6a7ebd786ab02a2a59dc7b336e607962455285d32b02"
    hash160     = "dedbb2dc29d29e6d2fee6f1b99b7f2b235f0af2e6b4083bba13080a8ccd89589"
    hash161     = "a5bc8836894704c76dd2f6d9a3d04fb577f80a025174a1e98acfd576e06e3c8b"
    hash162     = "d17dbf74c77d45542514dc76bf07157646ecfcfab97b7da4771267c9311fef3f"
    hash163     = "60fb13d8cc60b5e315624b1d5658af7c3c37d6b1a71644afbbf250f9933ae210"
    hash164     = "b60edd3e8d7efaa45be302942e31999dc42a2d19df21bfe82bc0e5194360da2d"
    hash165     = "f3c605324f2b00be1dcd517ff7a2579503dd3b5a470c8f122cafbe6f3b5790eb"
    hash166     = "81534f6333b69bc62c6e65d4804daefb5f8882ee651413042c75281bb0ed02ce"
    hash167     = "4237cb1b65bd368301aead002f23fb1efc5cb1776975eeb602681b4ba90929fe"
    hash168     = "b0bc5b0910d279bf15241f2b39103ac29839c00016c394498c3947929937c2f5"
    hash169     = "a4d73365d96c45209fdb47e17bbffe7cf0fd6f5896f65ce084230fc08b645b3e"
    hash170     = "1f3e5087f6ca1f85220d2fa3f9592a9e7ba176f333297263cf7e657ffc0161aa"
    hash171     = "dcec184b49800317e62b724db3699924530baccb70ee55be2d42a23600735519"
    hash172     = "c5ce7fffde7987b3bff700bf8adde6f6afa43e6f44da7ded9005dd5e20cab6e3"
    hash173     = "6aa73d2fa14e1d8224540815dd7b8148663c2ae6288f826f51910042c6d8d1b1"
    hash174     = "6beb66d6e4b060f361a06f7d85ecad113689bb9d33d376cb2ce544820f144d9f"
    hash175     = "ad9465811deb644d1cfecf12f4c984b52e3b11b819e477ff6faff207df2713d8"
    hash176     = "3f03e58cb29d9f6db6e584d142843e1f81515e45d53d3b6361957bd4674a9c33"
    hash177     = "f95679efc5e839df805f6fd2d93bf8400fe58cf8bb05152ccbbdd6e78185af09"
    hash178     = "d92d56a0e68f5823f5b19aa77e5794a48bafdd3efe82f5f4fd7471237130f7bc"
    hash179     = "aa27a05be12981b5b7e3c4322744207e81cf5345644efc20f374668566c3ecbb"
    hash180     = "0986716e11857c3f911b726dd0d905d141c3367fdd1b6e5397bae6a5204b3057"
    hash181     = "f8211eae18afd8e319d2d651500cdfc6cc379c99bf65469b4c84ab8eaa3a00ee"
    hash182     = "1d0cd953a29190d57cd7f61f8b6b65defd6536faa568c3e62f70011474d568f8"
    hash183     = "898e1f61a223d933ebe53a09d071f872cdc91dbb7426a48ff026a391767d8002"
    hash184     = "43da7d423fe85394ca7aa939ac5155b71147d39d774948b4a3b8223c726e1582"
    hash185     = "c71aca2714ae859592a47a96fccc14978a38e28be8884d53b0108247ca43d26a"
    hash186     = "78ebbfd91dc58a64a16e6c6e0f706313e4936abdaa1a030320ea44d09842ffe5"
    hash187     = "a78d09614fd4a9a8fe8780b982a64734d015a38c91fc5e458891265ce9fb87f0"
    hash188     = "4784ff61ea55b6d8252ce1a3677d75ba9bf61c8acdde4d720cba5f70f4845d97"
    hash189     = "d1a7cb08ba61304ed3229ac074a3d09c0085447f6fe6b628c9fa77f53bad78d8"
    hash190     = "44405c5dfb1ca35ebd078675a5e5dd9673fd48e33336d39a197850a6171ceedf"
    hash191     = "03067ddcc447b71d7e2681aa35d2078c1d0241721860d9f82381f1cff1af60b4"
    hash192     = "f4299c300f87bb0a2b3341dc12cf3c5d5c504f27fabaabefcf4b3d89420f6f98"
    hash193     = "f1fbcdb14d429241552fdee0f4dd2d6773b654623695612900035844e903e401"
    hash194     = "3cce7e8fa7b6c9043425b6fe3e1d11f36259bb930a499ba97266b667c7fba963"
    hash195     = "f651044c62b9866023b4336d1e4b9ed9b24fc431e8573d865d0a071fc49fae29"
    hash196     = "e4afdf7a7bed1b73cb1eb1c0ebe0f81a72f6dc82dd47a2bbd6a6eaac31276c32"
    hash197     = "fcf121631cd19badbe367dc39ba559b5f2a38d91890b3fe823f9ccc3baaf5ab6"
    hash198     = "7e5566bede05d4af0674289705acb8341462bf9a188affbaa9c216a85e5603e8"
    hash199     = "696e28054ee09d066ed287b589c157af5c5e31b5296b45e0c713f120b4ca28cc"
    hash200     = "64d7d07195f199b943d3a562209b4e760d453692a522dde3c4942e399d4a74f8"
    hash201     = "cc09ad48ba54df278104f5ea00e4168c9a7dc7a701a0119c4e4b45186a2d9a7e"
    hash202     = "f712ebb2dd0490eb928e464a70473e59059f5339f968eb6a76f57979ef6173c6"
    hash203     = "bc32aa0519a2577bc1457050c10727c186a6a1e082cb5800313c3c7200e8b0d1"
    hash204     = "36bc07968376cc73eb532bd41fa5651bfcde863ce1fb0b5c7d0365ffac415daf"
    hash205     = "6e9eff7b5321cd77ef0fbf76e26221bce81977c83e1801e4d95b7c31ce621005"
    hash206     = "770ffa4607153013123a9ac5604a8efc047411deccc59eec5a633574f4796a0f"
    hash207     = "04659c9cf0c0f9c5a89b56599e3ff54cfbcc1d539bd0e07ae9ff9d47468deabe"
    hash208     = "e9f31a0a90c469d98ff4c63e9aa08b5cc2e92cc35f9f3cb3a11dee8cb6e1654a"
    hash209     = "b9f621d9d5946022cebae882f4cde0d699bb06ce896915b7ac38dcab1b29ac79"
    hash210     = "0bd45d681f51ab44516b3829eb9e0d07a4142a2d9c65a3cabbbe44db8f70ca19"
    hash211     = "4d3d59e01cabdab115e1599d960d90f597d7c549959337f212bf3192524a708b"
    hash212     = "fb1bc03a1fc42b501059e3de85a3a5b9e056784b88cbfedc505ab48028f7c5fa"
    hash213     = "de326623969a60b02db7b41f56f5cc436105686962f7272fb1a66498f3a24b91"
    hash214     = "c9e2fdabade7a0be96d439d1ce5b06b43632601b33a210ca5332e9b6173c04e4"
    hash215     = "0fda996dd2062190db324f50783f85b0fec1b70ccdc9c66a3ce068363ec592aa"
    hash216     = "c695ad904bccbad519b8870953afe9bc5836cb0bd941682567f7544081ec9964"
    hash217     = "4138ec02d8d402979681b48f47794c1c01c1ce49e17dc436568d5e11c3c81a5b"
    hash218     = "d7b9a1a3df6982b5074d135844bc0a348be63031d9a521e4062b9362374adb8e"
    hash219     = "2823c709ef2f50d0bcec02db3233d85c9df52fd4b9729d0c953e1cf16d1cb4bd"
    hash220     = "1a4fcbb93548b439b9ebb3996e2b457c84820801fccce2f17b20b25dda94a807"
    hash221     = "9180a390bcd84c7d896180aa2e0611a9e9d7b8849b94f8ff7916e7030c82e1b4"
    hash222     = "fcc51646d95beaef6b39e7568f0cf26f022870ee38c44d9fcd2a0a524c222cd5"
    hash223     = "c52d4f7df439a39497f45814626279d1c40606a292b9f164baf82f7620d93424"
    hash224     = "7108b7448f1b622c637502fc5aabf1b8ad18a45c379f00ea43cdec33f32ff7b8"
    hash225     = "aafb6cffbb647fc6f868727fb0b8d6672ff61304ac65a9047f3b063cbac995b6"
    hash226     = "30d929003dc1c50b400e3dff19978da206c86079e828da1d870f6a0cfcc3c5ae"
    hash227     = "58eb1d64653d1484767d8787857228d2eea34e468147148eabe5d7be17fb443f"
    hash228     = "cf8ae1c08ad28a63d125cefb3019669e3e9df9974fcadbb4c382c6569926a1b9"
    hash229     = "f6c12666bafb687866fe4257c40bf01ba86598260bd6a403eb40658f3998863f"
    hash230     = "56b282d7b0ffcdb4b51e2a70e00c8ff8c70e5e906700130ce44bcbd3e1e4a055"
    hash231     = "3cb232f8309e42afd66bb47a9f209dc7cad2e4d4d84cb0cf17ae26b9753ea454"
    hash232     = "2041f14f372e754a89b87475488eb37a1b4764c406cc711078b0278e823e39e7"
    hash233     = "ec7d9e24f14e88e95699d304be05a369b5aefc2d58d3ffa759225b3d7931383b"
    hash234     = "8e1d5582f944546ee7f4ee229d35f75d80f618c4085e99c328fafb0e51a2203c"
    hash235     = "ffd68fab02ceefe17fd3b7958d3b6af2393991ef7141e9f6e50ac29454d08c7e"
    hash236     = "ed173ea5c032f5bc497128b4486cdadb568942d3f61c76e63dfaf6ed6f8af4d9"
    hash237     = "4a74a17d8745091fa88bf4d8993b5da994adf68d5576e43b3e1ebcc9aec5fe82"
    hash238     = "299c2638b0ad730d9bde77d253a0b7344ed8660e6f6db0f6300d2b6d619a3eb3"
    hash239     = "566999abebc9cc30feb0051d5efe34f0aef3809d09587bfd0794a81d3941ff8b"
    hash240     = "368cd9b11a6d671ed0fd6802a8d9ffe7acfab3ec2be0537818cf240a2b1f254a"
    hash241     = "8e849d021760a74de53ebe7389ee60af26cee5616e5e76dddb6b11049f349d78"
    hash242     = "409e6cc99b3a3e1abaabdda9aab6ada040fa1bc0ed1a267103d300efc0fcafb1"
    hash243     = "67f987ea576fbbf28209364af95294da95c547dc1544782ecfaeb98275e79618"
    hash244     = "ca20053efc86794143f7646f206fb8ed1cd9fac5a8c942f5bcf3720035876331"
    hash245     = "897a8192dce0a8c7e834aab37f803da9046d1af69374ae1eb82b8b327dec6efb"
    hash246     = "c19692c47b029e89c876ca86bca44c7f56da43c4fbb3646aab664191de79de73"
    hash247     = "be530438b12c1272aa1c9d8afd499a9bdd6584c056f3b1490608994f49ef4419"
    hash248     = "4e2e363e511c48e9517911dbff181add396b87aeb162d340866ae8314733c7da"
    hash249     = "970e196efaedebd5a812e866938fe562c66f5b2ae4b1d16a34da9203d8094453"
    hash250     = "a15f22f88bd0372fe83a0594ad3bff8686070d7f5041b4a5fccb5a79e1f226c5"
    hash251     = "dc3937690175a8e9e661dbb165bd05b811ca24c2fe954aedf47a4dc06389d254"
    hash252     = "06d3501ed55a76c1d0d6b1b496950d26e61d0d7e1b58799df5e4f7e1d69dd631"
    hash253     = "a8ec2a5a79470c39e46548d0b7d9c886527797f0a8ae914d600c173c50713ec6"
    hash254     = "2947f14489d8738af9aa3f8a20f20eb6d1d1acafcd4b1937e70444b31349e725"
    hash255     = "325b5a389bad02699a8e6ab4d5bc23fc5073b7dd9aa868b611cd622e300d18dc"
    hash256     = "64cca984ee35ffe04b1dba4421a9d3840acafa4ccc6c765ff2bfd605392e9e45"
    hash257     = "d332bb4f021b5c11e7dd4072a5f413f2b66d5a4a5040e50c44b6813cdd6e3eba"
    hash258     = "7d4c9a8a7bcd7a217b8d7867143e3412f1cfcd95ceb1ea36b436839a9308724f"
    hash259     = "6d908fa4653798434b262c700c154c1c6760ebd88ab7a93f75fe8ce4af189233"
    hash260     = "3d5b241906bbf29ba1ea0831cd0d20a5ab962db92a6570d58cdd91634610a6c6"
    hash261     = "9a8fbdca25e77690c15f27f3b4a3384765e0845de664c342c0005c1a2fc548db"
    hash262     = "6e95f086fd8f7992973990796e1ad82998c3a27744ef8ca4ef5db60e47896990"
    hash263     = "eebed1af08982034d2f6261f6b2e6ce46341e030b0345e54a6cf596d6fa6bcb9"
    hash264     = "21013b5f0340542034e154e6ec0b30b6018a3cf47da9828617d4dd6a157dd20d"
    hash265     = "48e102e8a1b7bd9ca6f4c864496955b6c270ac74a8c7881dce80524e96efa930"
    hash266     = "d226bdea4a3fe3561961d47004680f5949a6449616865f3b5e6c70eb74e7d0a4"
    hash267     = "6008607cb8cb4eaa01c8594862574ef45660beb43f592bcde2c629a0eb100b07"
    hash268     = "a28c7ba5387154b0262eb82f3b4f5b057666e40617d1590f243015b5055fb8a0"
    hash269     = "ebada625c98c02558d37f6b2864a448851bfbf4d3f01de58a3bebd600cc69deb"
    hash270     = "a178782dcbaa23fe6e0fc8acc564214e16c613254bcddabcad424991d687b068"
    hash271     = "493c9e5e89d1afc11b07a27f57819d023566f0b1491021ab7f994c74f7cec4cd"
    hash272     = "16f5727283eee5967e494180eb24ea90d3c5866d48c67c5f74bad067bae3b650"
    hash273     = "55944938d2852cf331b9a0334d2ce67f4138ef472574497d8013a649f1509e8b"
    hash274     = "4d8ed3c8f56e0933b5828bccedc83d1cf8ed7aafa81ddb3fd3e32b937a05c9eb"
    hash275     = "863b9b6287058fa793e01abe46c2a0f440ae06381eb82a815b46769453a69a61"
    hash276     = "baaf51ffbf4f5e915ba4911828865fd413197887d760e5546cb6f32b265ffef4"
    hash277     = "6084a211806263e4193d650c10179fc30faf877a4ea704e49ffbd9e0c25c5a63"
    hash278     = "84c07a3c091d22118b1c62a45ca5028cd237295b0f51c7d697782ece20823d7a"
    hash279     = "343c0cd1d15a52a56cef412f3b37ca47070ad6eb2aa6b4b592fb89cd85c3c114"
    hash280     = "3ad91e1b1187f476a6233dc57231bfa601811f8d16023459cb32df8c0fa4340a"
    hash281     = "c32b0c4c8b1ada31526f8c14ea7915451599ba3b276088f2832b1e25940c4c5a"
    hash282     = "9593af7ce5eb05feff4b2918fa3004db52ff7c631c58c06053a52991e385a59c"
    hash283     = "aa283e48a2d38e3aaf7a402db2118dfa3f58abd2610d6a51ba2d6c223571a115"
    hash284     = "528eb673ec37e34cd7865ac01d37152e1578b8ec3d4f71ee91d2f1a166a55d6d"
    hash285     = "f482531b49c1d85f86713dbb73e36a7b2fa126bae8cc4ce86b9f0dfb3bf99b0e"
    hash286     = "b05fa04b8d43317aa1498c3cd8326aabc6e16b1fc990d0ae557f9dc026062728"
    hash287     = "9b46f404be6b52b6f0ceba4d22d374446ee3747eeae26fc50acdab603b07a64e"
    hash288     = "57c56ac9023320fe9ae647946215562490fd5e9fc106b5717f6f73f97e81cc5d"
    hash289     = "7529c176a2ad4b9045e8dffe7f6be7fca6fbe1f34a15953fec603a5efcfe371c"
    hash290     = "cc36dfc9476466fa055048b85027f965cedf4db01227bd0c6a305b15a04cfa5d"
    hash291     = "c50a977045997e2d997920bb9c9cf3c4239419131abe4b315cdfe11232887776"
    hash292     = "363d8afbcda82e6831f734cc55e78cf57baf1392a684b1bc90edb6a781d23242"
    hash293     = "83e6a5762e6b048d7c324eb49acd72233a14519a8c6b0cb72966d76b440df510"
    hash294     = "bbf216257bb053f72851482e788d08a852673c13ed9024ff5bd18a77cda93297"
    hash295     = "641ca7bcda09b832cd9ece6370fb1896bb69e36a3fcaddd0cbe8ff89da9c53dc"
    hash296     = "ffcf9965fadd9e30cb49940b40ef7539f9a9810c5eadaa9159d73a7727cc7de9"
    hash297     = "d399b67888466ade129a50c43d91c77b0dd69ad1d90f33859386ac6f59ce8300"
    hash298     = "a2eb4e40e9b194f6071670b9b125a3cd11810e1698f43e9ffee4d109b5263d44"
    hash299     = "334b29c012a8fa4f6d1291eb7c82852bec31c31407c74f3699e4a952b5e7215a"
    hash300     = "8d951ddeb596a7882c0a45b310721d4896bcd8da52f6e35d75c43102c053d8ac"
    hash301     = "51174dd13b2980605d70c930b3b5c57224a1197de25e8c9d1cf3a4e37b4bd2e9"
    hash302     = "f41d6da2f2d72d6d389ac09536ee9dccd11679f7a83a93869fe3be908cf12d6f"
    hash303     = "5315fbb68ac73b4e26fda2dd1c43e0d3998bd8b80ae843dfb58a7e94cf16dcf2"
    hash304     = "a7e8ecbb9c5ef6e05dd2922c1e83c9d94c63c7b0995bde2588d8a03382913f6e"
    hash305     = "e4e22ea840d9d498d3c668046df0447e2a947c92f5d330f7f357df35fa1ee133"
    hash306     = "6c426e7023b70017f892abcf4c6e1329bd95fa920f938adb33d0bde5b1239db6"
    hash307     = "cdc838911d3418ab64c9afdc7c84e78c3e65c7497c2b8f1805aff3949b74450b"
    hash308     = "da51d20a0ebe750c0e108df5c1652fe02284d8e2957419e72bccbe673b635532"

  strings:
    $s1 = "History> <rdf:Seq> <rdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when" ascii
    $s2 = "18-12-02T15:50:06+08:00\" stEvt:softwareAgent=\"Adobe Photoshop CC 2018 (Windows)" fullword ascii
    $s3 = "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/> <rdf:li stEvt:action=\"converted\" stEvt:parameters=\"from" ascii
    $s4 = "History> <rdf:Seq> <rdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when" ascii
    $s5 = "nstanceID=\"xmp.iid:d5974899-ca88-7f42-9516-8e7635808df3\" xmpMM:DocumentID=\"adobe:docid:photoshop:953273c3-3fa6-8f45-b6a0-9baf" ascii
    $s6 = "nstanceID=\"xmp.iid:d5974899-ca88-7f42-9516-8e7635808df3\" xmpMM:DocumentID=\"adobe:docid:photoshop:953273c3-3fa6-8f45-b6a0-9baf" ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d9b30b9c-b0b2-4e8d-9d20-70ce8933ad1a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion